Expose frontend HTTP endpoints over HTTPS

Security · Application Gateway · 2021_09

Application Gateways should only expose frontend HTTP endpoints over HTTPS.

Description

Application Gateways support HTTP and HTTPS endpoints for backend and frontend traffic. When using frontend HTTP (80) endpoints, traffic between client and Application Gateway is not encrypted.

Unencrypted communication could allow disclosure of information to an un-trusted party.

Recommendation

Consider configuring Application Gateways to only expose HTTPS endpoints. For client applications such as progressive web apps, consider redirecting HTTP traffic to HTTPS.

Configure with Azure template

To deploy Application Gateways that pass this rule:

• Set the properties.frontendPorts.properties.port property to 443.

Fors example:

Azure Template snippet

{
    "type": "Microsoft.Network/applicationGateways",
    "apiVersion": "2020-11-01",
    "name": "appGw-001",
    "location": "[resourceGroup().location]",
    "properties": {
        "sku": {
            "name": "WAF_v2",
            "tier": "WAF_v2"
        },
        "sslPolicy": {
          "minProtocolVersion": "TLSv1_2"
        },
        "frontendPorts": [
          {
            "name": "https",
            "properties": {
              "Port": 443
            }
          }
        ]
    }
}

Configure with Bicep

To deploy Application Gateways that pass this rule:

• Set the properties.frontendPorts.properties.port property to 443.

For example:

Azure Bicep snippet

resource name_resource 'Microsoft.Network/applicationGateways@2019-09-01' = {
  name: 'appGw-001'
  location: location
  properties: {
    sku: {
      name: 'WAF_v2'
      tier: 'WAF_v2'
    }
    sslPolicy: {
      minProtocolVersion: 'TLSv1_2'
    }
    frontendPorts: [
      {
        name: 'https'
        properties: {
          Port: 443
        }
      }
    ]
  }
}

Links

• Data encryption in Azure
• Create an application gateway with HTTP to HTTPS redirection using the Azure portal
• Azure deployment reference

---

Last update: 2022-10-17

Comments