Protect web app

Hi @JMN-2253,
The ERROR 403 - Forbidden issue when accessing your App Service Web App behind Azure Front Door, ensure that your web app is configured to accept requests only from Azure Front Door.

1. Ensure your web app checks the X-Azure-FDID header, which is added by Azure Front Door and contains the Front Door ID. If the header value does not match your Front Door ID, the web app will return a 403 Forbidden response. Verify the header is sent correctly and that your web app is set to accept it.
2. Confirm that your web app's network access settings allow traffic from the Azure Front Door IP address ranges. Configure IP address filtering to accept requests only from the AzureFrontDoor. Backend service tag, which includes the IP addresses used by Azure Front Door.
   references:
   https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/protect-api-hosted-apim-by-waf#restrict-apim-access-through-the-azure-front-door-only
   https://learn.microsoft.com/en-us/azure/frontdoor/origin-security?pivots=front-door-standard-premium&tabs=app-service-functions#public-ip-address-based-origins

@Laxman Reddy Revuri ,

It is very unprofessional to answer without seeing the original post!

You just wasted my time reading your response!
This form becomes full of copy-paste from articles, People who just trying to fill their time!!!!

Hi @JMN-2253,
My apologize for any inconvenience caused on this.
please consider incorporating the AzureFrontDoor.Backend service tag in your access restrictions. This approach will ensure that only Azure Front Door can access your App Service, irrespective of the header. Check Azure App Service logs to confirm if the incoming requests have the correct X-Azure-FDID.
A reference string that identifies the request came from a specific Front Door resource. The value can be seen in the Azure portal or retrieved using the management API. You can use this header in combination with IP ACLs to lock down your endpoint to only accept requests from a specific Front Door resource.
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-http-headers-protocol#from-the-front-door-to-the-backend

Hi @Laxman Reddy Revuri ,

In my first post "X-Azure-FDID value is the Front door id" and the screenshot shows AzureFrontDoor.Backend service tag in your access restrictions.

However, it is worth mentioning I had to add this entry, the front door didn't create it by default.

Hi @JMN-2253,

If your App Service is expecting a specific hostname, it might be rejecting requests coming through Front Door. Make sure the backend hostname in Front Door matches what your App Service expects. If Front Door is terminating SSL and sending plain HTTP to the backend, your App Service might be blocking it. Ensure it's correctly handling the forwarded protocol.

Your App Service might also be enforcing authentication, which could be preventing requests from going through. If you have App Service Authentication enabled, check that it’s allowing traffic from Front Door. CORS settings could also be a problem—if your app is expecting requests from a specific origin, it might be blocking ones coming through Front Door.

Another thing to check is whether your App Service is integrated with a VNet or has firewall rules in place that are preventing traffic from Front Door. Even if you've allowed the Front Door service tag, there could be a misconfiguration. If your application itself has request validation, such as checking headers like Referer or User-Agent, it might be rejecting requests from Front Door. Try logging incoming requests at the app level to see what’s actually reaching it.

Hope it helps!

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.