I had the privilege of leading two technical sessions for Arq Group, a division of NCS Australia, aimed at facilitating the transition to Microsoft Teams and Azure. Previously reliant on Slack, the organization now seeks to embrace the Microsoft ecosystem, and I was honored to guide them through this migration process.
The sessions saw a remarkable turnout, with over 400 enthusiastic participants actively engaging in the discussions and activities.
In this article, I'll illustrate how Azure Front Door Web Application Firewall (WAF) shields against Cross Side Scripting (XSS) attacks, ensuring robust protection for your applications.
I'm leveraging Azure Front Door Premium, which includes a WAF policy with managed rulesets, providing enhanced security measures for my applications.
We will start the process by assigning the Microsoft Default ruleset to the WAF policy.
That's all we need to do. The WAF will handle the rest.
Let's attempt to simulate a Cross Site Scripting (XSS) attack.
Azure Front Door WAF has effectively countered the attack. Let's examine the WAF logs to review the outcomes. I'm utilizing a simple KQL query as below.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
and action_s == "AnomalyScoring"
| project requestUri_s, ruleName_s, details_data_s,details_matches_s, action_s
When an Azure App Service is exposed through Azure Front Door, it utilizes the public address and directs the traffic over the public network. However, we can leverage Azure Front Door as the gateway and restrict all public traffic to our origin (Azure App Service app) by utilizing the Private Link integration feature available in Azure Front Door Premium.
Private Link integration enables Front Door to connect with your origin using the Private Link service. This approach eliminates the necessity for your origin to be accessed over the public internet. Instead, it permits Front Door to access the origin using Microsoft's backbone network.
This process establishes the Private Link connection for the origin and necessitates your approval at the origin.
# Login to Azure environment and select the subscription
az login
az account set --subscription "My Demos"
# Create SQL instance and firewall rules
az sql server create --name srv-sql-sonarqube --resource-group rg-sonarqube --location australiaeast --admin-user sonar --admin-password [Password]
az sql server firewall-rule create --resource-group rg-sonarqube --server srv-sql-sonarqube -n AzureServices --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0
# Create the database in SQL instance
az sql db create --resource-group rg-sonarqube --server srv-sql-sonarqube --name sonarqubeDb --service-objective S0 --collation SQL_Latin1_General_CP1_CS_AS
# Create a container instance with offical SonarQube image
az container create --resource-group rg-sonarqube --location australiaeast --name sonarqube --cpu 2 --memory 3.5 --image sonarqube:7.7-community --os-type Linux --ip-address Public --environment-variables 'SONARQUBE_JDBC_USERNAME'='sonar' 'SONARQUBE_JDBC_PASSWORD'='[Password]' 'SONARQUBE_JDBC_URL'='jdbc:sqlserver://srv-sql-sonarqube.database.windows.net:1433;database=sonarqubeDb;user=sonar@srv-sql-sonarqube;password=[Password];encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.database.windows.net;loginTimeout=30' --ports 9000 --protocol TCP
Following is a generic method to send email with attachments using Azure service principle with Mail.Send permission.
This approach is more secure than classic SmtpClient.SendEmail method. Service principal approach allows you to authenticate using Azure Active Directory, which provides a more secure way of authenticating than using a username and password.
You need to supply Client ID, Tenant ID and Client Secret as parameters.
public async Task<bool> SendGraphEmailAsync(Email email,string clientId, string tenantId, string clientSecret)
{
bool result = false;
var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret);
BlobService blobService = new BlobService();
SharePointRepository sharePointRepository = new SharePointRepository();
//method to get email template from blob storage template container
var emailTemplate = await blobService.ReadFileFromBlob("Email-Template.html", "template");
//method to get attachment from sharepoint
var csvAttachment = await sharePointRepository.GetAttachmentFromSharePointAsBiyes(email.CSVName);
var message = new Message
{
Subject = email.Subject,
Body = new ItemBody
{
ContentType = BodyType.Html,
Content = emailTemplate.ToString()
},
From = new Recipient
{
EmailAddress = new EmailAddress
{
Address = email.From
}
},
CcRecipients = new List<recipient>
{
new Recipient
{
EmailAddress = new EmailAddress
{
Address = email.SingleCC
}
}
},
ToRecipients = new List<recipient>
{
new Recipient
{
EmailAddress = new EmailAddress
{
Address = email.SingleTo
}
}
},
Attachments = new List<microsoft .graph.models.attachment="">
{
new FileAttachment
{
OdataType = "#microsoft.graph.fileAttachment",
Name = email.CSVName.Split('/').Last(),
ContentType = "text/csv",
ContentBytes = csvAttachment,
}
},
};
Microsoft.Graph.Users.Item.SendMail
.SendMailPostRequestBody requestbody = new()
{
Message = message,
SaveToSentItems = false
};
var scopes = new[] { "https://graph.microsoft.com/.default" };
var graphClient = new GraphServiceClient(clientSecretCredential, scopes);
try
{
await graphClient.Users[email.From]
.SendMail
.PostAsync(requestbody);
return result;
}
catch (Microsoft.Graph.ServiceException)
{
throw;
}
}
Hope that helps