Repository navigation
Replies: 2 comments
|
In order to use Keycloak behind a Firewall with OWASP ruleset, you need to configure a lot of exceptions - either disable some rules completely or excempt certain parameters from being checked. For example any parameter that has more or less random content (authcodes, tokens, sessions IDs, etc.) would randomly be blocked by the WAF so you need to exclude it. |
0 replies
|
@mukesh47 Hello, were you able to make the exclusions as you wished? If so, do you have any examples of exclusions for having a Keycloak behind an AGW + WAF? |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
We are using Keycloak for authentication and have Azure Application Gateway WAF (Web Application Firewall) enabled with the OWASP CRS 3.2 rule set. We are encountering an issue where legitimate authentication requests are being blocked due to the following rule:
/auth/realms/<redacted-realm>/broker/oidc/login?session_code=...&client_id=<redacted-client>&tab_id=...KC_RESTARTcookieThe WAF log indicates that a pattern match (
(?i:(?:\A|[^\\d])0x[a-f\\d]{3,})) was found within theKC_RESTARTcookie, triggering the SQL injection rule. However, this appears to be a false positive, as the request is part of the standard authentication process.Has anyone encountered this issue with Keycloak and Azure WAF? How can we best handle this while maintaining security? Would a rule exclusion for this specific request or cookie be recommended, or is there a better way to mitigate this?
All reactions