Azure AppServices requests throttling

199 Views Asked by At

I have an Angular Application hosted in Azure AppServices, I get too many requests to my AppServices from malicious attackers, how do I configure request throttling for my Azure AppServices.

1

There are 1 best solutions below

1
On

There are several options. Will depend on your specific use case.

Option 1 You can use Azure Application Gateway with the Web Application Firewall (WAF) feature. Here's a general approach:

  1. Set Up Azure Application Gateway with WAF:

    • Create an Azure Application Gateway instance.
    • During creation, enable the Web Application Firewall and choose the appropriate WAF tier and policy.
    • Configure the backend pool to point to your Azure App Service.
  2. Configure Custom WAF Rules:

    • Go to the Web Application Firewall under the Application Gateway.
    • Create a custom rule to define the request threshold. For example, you can limit the number of requests from a single IP address over a time interval.
    • Assign the custom rule to the WAF policy.
  3. Update DNS:

    • If you have a custom domain for your app, update its DNS to point to the Application Gateway's frontend IP instead of the App Service directly.
  4. App Service Access Restrictions:

    • To ensure that traffic only comes via the Application Gateway, go to your Azure App Service's "Networking" section.
    • In the "Access Restrictions" pane, allow traffic only from the Application Gateway's subnet and block all other traffic.

Option 2 Rate Limiting Middleware for App-Level Rate Limiting If your Angular application has a backend component (e.g., Node.js), you can implement rate limiting directly within your application using middleware. Like, in a Node.js backend, you can use the express-rate-limit package. This allows you to define rate limits for specific routes or globally for your entire application.

Option 3 Azure Functions Proxies

Azure Functions support Proxies can reroute requests and transform data. While they do not natively support throttling, you can combine them with function code to inspect and act on requests based on volume, source IP, etc.

Option 4 IP Restrictions

If you have a known list of IP addresses from which legitimate traffic originates, you can set up IP Restrictions in Azure App Service to allow only traffic from those IPs. This doesn’t help with rate limiting but can reduce malicious traffic.

Option 5 API Management for Throttling API Requests. If the requests you see are for any API which you are hosting in App Service. You can implement request throttling for APIs using Azure API Management