Skip to content

Commit ace2ffb

Browse files
authored
Update front-door-faq.yml
1 parent 7fee41a commit ace2ffb

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/frontdoor/front-door-faq.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -201,8 +201,8 @@ sections:
201201
- question: |
202202
How does Front Door handle ‘domain fronting’ behavior?
203203
answer: |
204-
Beginning November 8, 2022, all newly created Azure Front Door (Standard, Premium and Classic tier) or Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibits domain fronting behavior. Requests where the host header in HTTP/HTTPS requests that doesn't match the original TLS SNI extension used during the TLS negotiation gets blocked. Starting from September 25 2023, Azure Front Door updated the domain fronting blocking restrictions based on feedback from customers while not compromosing security. Instead of blocking a requests when the SNI and host headers do not match, AFD is allowing the mismatch as long as the two are owned by the same subscription. Starting from November 8 2023, AFD will enforce domain fronting blocking on all existing domains.
205-
resource information. Once domain fronting gets blocked, Azure Front Door and Azure CDN Standard from Microsoft (classic) resources block any HTTP/HTTPS requests that exhibit this behavior.
204+
Beginning November 8, 2022, all newly created Azure Front Door (Standard, Premium and Classic tier) or Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibits domain fronting behavior. Requests where the host header in HTTP/HTTPS requests that doesn't match the original TLS SNI extension used during the TLS negotiation gets blocked. Starting from September 25 2023, Azure Front Door updated the domain fronting blocking restrictions based on feedback from customers while not compromosing security. Instead of blocking a requests when the SNI and host headers do not match, AFD is allowing the mismatch as long as the two are added as domains in the same subscription. Starting from November 8 2023, AFD will enforce domain fronting blocking on all existing domains.
205+
Once domain fronting gets blocked, Azure Front Door and Azure CDN Standard from Microsoft (classic) resources block any HTTP/HTTPS requests that exhibit this behavior.
206206
207207
When Front Door blocks a request due to a mismatch:
208208
- The client receives an HTTP "421 Misdirected Request" error code response.

0 commit comments

Comments
 (0)