403 禁止 microsoft-azure-application-gateway/v2

Question

I currently have a WordPress website hosted on 3 virtual machines behind an application gateway. When users are trying to submit a form via our websites sponsorship pane, after clicking submit users are prompted with: 403 forbidden microsoft-azure-application-gateway/v2

I've done a significant amount of research and viewed the logs and I'm not seeing any red flag that is causing restricted access to the resource. The WAF is set to prevention so maybe it's seeing the form submission as a type of malicious activity and blocking it? Not quite sure at this point though.

I am not a web master, so my scope of service stops after it leaves the Azure portal.

Please advise.

Answer 1

After digging around the WAF logs, the way that the form is being transmitted to the website is being flagged as malicious and classifying the request as an SQL injection attack.

How I mitigated it in two ways:

1. Navigated to the Web application firewall (WAF) and disabled the rule in question
2. Add specific custom rules for exclusions for specific URLs