The diagnostic log indicates that the Web Application Firewall (WAF) blocked the request due to rule 942440, which detected a potential SQL Injection attack. The Matched Data field shows the pattern 1=1 was found within ARGS:text. The term ARGS refers to the request arguments, such as query string parameters or the request body.

The proposed solution is to create an exclusion for request headers. This solution is incorrect because the WAF detected the pattern in the request arguments, not the headers. An exclusion rule must target the specific attribute where the false positive occurs. Therefore, this solution will not prevent the WAF from blocking the request.

A. Yes: This is incorrect because the proposed exclusion targets the wrong request attribute (headers). The block is occurring in the request arguments, so the solution will be ineffective.

1. Microsoft Learn

Azure Web Application Firewall (WAF) exclusion lists on Azure Application Gateway. This document details the request attributes that can be excluded. It explicitly lists "Request arg name" as a match variable

which would be the correct attribute to target in this scenario

not "Request header name".

Reference: In the "Exclusion attributes" section

see the table listing the supported "Match variable" values.

2. Microsoft Learn

Troubleshoot Web Application Firewall (WAF) for Azure Application Gateway. This guide explains how to interpret WAF logs. The details.data field shows what was matched in the request

and the log entry in the question clearly states the match was in ARGS:text

confirming the issue is in the request arguments.

Reference: See the "Understanding WAF logs" section for descriptions of log fields like matchedDatas and detailsdatas.

3. OWASP

Core Rule Set Project. The rule ID 942440 corresponds to the OWASP ModSecurity Core Rule Set (CRS) rule for "SQL Injection Attack: SQL Tautology Detected." This rule specifically inspects request arguments and other locations for common SQL injection patterns like 1=1.

Reference: OWASP CRS documentation for rule 942440 in the REQUEST-942-APPLICATION-ATTACK-SQLI.conf file.