Expose frontend HTTP endpoints over HTTPS#
Security · Application Gateway · 2021_09
Application Gateways should only expose frontend HTTP endpoints over HTTPS.
Description#
Application Gateways support HTTP and HTTPS endpoints for backend and frontend traffic. When using frontend HTTP (80) endpoints, traffic between client and Application Gateway is not encrypted.
Unencrypted communication could allow disclosure of information to an un-trusted party.
Recommendation#
Consider configuring Application Gateways to only expose HTTPS endpoints. For client applications such as progressive web apps, consider redirecting HTTP traffic to HTTPS.
Configure with Azure template#
To deploy Application Gateways that pass this rule:
- Set the
properties.frontendPorts.properties.port
property to443
.
Fors example:
Azure Template snippet
{
"type": "Microsoft.Network/applicationGateways",
"apiVersion": "2020-11-01",
"name": "appGw-001",
"location": "[resourceGroup().location]",
"properties": {
"sku": {
"name": "WAF_v2",
"tier": "WAF_v2"
},
"sslPolicy": {
"minProtocolVersion": "TLSv1_2"
},
"frontendPorts": [
{
"name": "https",
"properties": {
"Port": 443
}
}
]
}
}
Configure with Bicep#
To deploy Application Gateways that pass this rule:
- Set the
properties.frontendPorts.properties.port
property to443
.
For example:
Azure Bicep snippet
resource name_resource 'Microsoft.Network/applicationGateways@2019-09-01' = {
name: 'appGw-001'
location: location
properties: {
sku: {
name: 'WAF_v2'
tier: 'WAF_v2'
}
sslPolicy: {
minProtocolVersion: 'TLSv1_2'
}
frontendPorts: [
{
name: 'https'
properties: {
Port: 443
}
}
]
}
}
Links#
- Data encryption in Azure
- Create an application gateway with HTTP to HTTPS redirection using the Azure portal
- Azure deployment reference
Last update:
2022-10-17