Introduction

Modern cloud applications require:

• Low latency

• High availability

• Global routing

• SSL termination

• DDoS protection

• Web Application Firewall (WAF)

Azure Front Door (AFD) is Microsoft's global application delivery service that routes user requests through Microsoft's edge network to the most appropriate backend service.

A typical architecture looks like:

Users
   │
   ▼
Azure Front Door
   │
   ▼
Azure App Service
   │
   ▼
Database / APIs

Benefits of Azure Front Door

• Global load balancing

• SSL offloading

• Improved performance

• Web Application Firewall integration

• Origin health monitoring

• Custom domain support

• Path-based routing

• Centralized ingress point for distributed applications

---

Azure Front Door Fundamentals

Azure Front Door is a Layer-7 reverse proxy capable of routing HTTP and HTTPS traffic.

Request Flow

Browser / Client
       │
       ▼
Azure Front Door Endpoint
       │
       ▼
Route Matching
       │
       ▼
Origin Group
       │
       ▼
Origin (App Service)

Core Components

Endpoint

The public-facing DNS endpoint.

Example:

mydiary-cud7d3eahthmcre9.z02.azurefd.net

---

Route

Determines how incoming requests are matched and forwarded.

Examples:

/*

/api/*

---

Origin Group

A collection of backend services.

Example:

default-origin-group

Origin groups provide:

• Failover capability

• Health monitoring

• Traffic distribution

---

Origin

The actual backend service.

Example:

slazmydiary01.azurewebsites.net

---

Configuring Azure Front Door with App Service

Step 1: Deploy App Service

Deploy your ASP.NET Core API.

Example:

https://myapp.azurewebsites.net

Validate that endpoints work directly:

GET /api/health
GET /api/expense
POST /api/auth/login

---

Step 2: Create Azure Front Door

Create an Azure Front Door Standard or Premium profile.

Recommended for production:

Azure Front Door Standard

---

Step 3: Create an Origin Group

Example:

app-origin-group

Recommended Health Probe Settings:

Protocol: HTTPS
Path: /health
Interval: 30 seconds

---

Step 4: Add App Service as Origin

Example configuration:

Origin Type: App Service
Host Name: myapp.azurewebsites.net
HTTPS Port: 443
Origin Enabled: Yes

---

Step 5: Configure Route

Recommended route configuration:

Pattern to Match: /*
Origin Group: app-origin-group
Origin Path: Empty
Forwarding Protocol: Match Incoming Request

---

Step 6: Enable HTTPS Redirection

Enable:

Redirect all traffic to use HTTPS

This ensures:

• Secure communication

• Better security compliance

• Prevention of accidental HTTP access

---

Advanced Azure Front Door Features

Custom Domains

Instead of:

myapp.azurefd.net

Use:

api.contoso.com

Benefits:

• Branding

• Easier management

• Better user experience

---

Web Application Firewall (WAF)

Protect applications from:

• SQL Injection

• Cross-Site Scripting (XSS)

• Malicious Bots

• OWASP Top 10 attacks

Architecture:

Internet
    │
    ▼
Azure Front Door + WAF
    │
    ▼
App Service

---

Path-Based Routing

Useful for microservices.

Example:

/api/users/*      → User Service
/api/orders/*     → Order Service
/api/payments/*   → Payment Service

---

Health Probes

Azure Front Door continuously checks backend health.

Example:

GET /health

Benefits:

• Automatic failover

• Faster recovery

• Improved reliability

---

Caching

Ideal for:

Images
CSS
JavaScript
Static Content

Avoid caching:

JWT-secured APIs
Authenticated endpoints
User-specific data

---

Private Link Integration

Available in Azure Front Door Premium.

Architecture:

Internet
    │
    ▼
Azure Front Door
    │
    ▼
Private Link
    │
    ▼
App Service

Benefits:

• Backend not publicly exposed

• Improved security posture

---

Security Best Practices

Restrict Direct Backend Access

Validate requests originate from Front Door.

Example:

var fdid = Request.Headers["X-Azure-FDID"];

Useful headers:

X-Azure-FDID
X-Forwarded-Host
X-Azure-ClientIP

---

Enforce HTTPS Everywhere

Always use:

https://

Avoid:

http://

for production APIs.

---

Secure APIs Using JWT

Example:

[Authorize]
[HttpGet("expense")]
public async Task<IActionResult> GetExpenses()
{
    ...
}

---

Enable Application Insights

Monitor:

• Failures

• Dependency calls

• Exceptions

• Performance

---

Troubleshooting Guide

Scenario 1: 503 or 504 Errors

Symptoms:

504 Gateway Timeout

Check Origin Health

Azure Front Door
    └─ Origin Group
          └─ Health Status

---

Test Origin Directly

Test:

https://myapp.azurewebsites.net/api/expense

If origin fails:

Application issue

If origin succeeds:

Front Door configuration issue

---

Scenario 2: Route Misconfiguration

Example:

Pattern = /api/auth/*

Works:

/api/auth/login

Fails:

/api/expense

Recommended:

Pattern = /*

---

Scenario 3: Authentication Failures (401)

Symptoms:

401 Unauthorized

Investigate:

OnAuthenticationFailed
OnTokenValidated
OnChallenge

Enable detailed logging.

---

Scenario 4: Verify Request Came Through Front Door

Check headers:

X-Azure-FDID

Example:

X-Azure-FDID: fbadd70b-8340-48a6-a0c2-78830a17bdcf

Additional useful headers:

X-Forwarded-Host
X-Original-URL
X-Azure-ClientIP

Example:

X-Forwarded-Host: myapp.azurefd.net
X-Original-URL: /api/expense

---

Scenario 5: Authorization Header Issues

Verify:

Request.Headers["Authorization"]

Expected:

Authorization: Bearer eyJ...

Missing authorization header typically causes:

401 Unauthorized

---

Scenario 6: HTTP to HTTPS Redirect and JWT Authentication

Real-World Case Study

A Front Door route was configured with:

Redirect all traffic to HTTPS = Enabled

Request:

http://myapp.azurefd.net/api/expense

Flow:

Client
   │
   ▼
HTTP Request + JWT
   │
   ▼
301 Redirect
   │
   ▼
HTTPS Request

Some HTTP clients may drop the Authorization header after following the redirect.

Result:

401 Unauthorized

while the application itself remains healthy.

Symptoms

Observed behavior:

myapp.azurefd.net/api/expense

Failed

while

https://myapp.azurefd.net/api/expense

Worked successfully.

Root Cause

The request was initially sent over HTTP and redirected to HTTPS.

The Authorization header was not preserved during the redirect flow.

Resolution

Always invoke APIs directly using HTTPS:

https://myapp.azurefd.net/api/expense

Avoid:

http://myapp.azurefd.net/api/expense

---

Useful Diagnostic Headers

Header	Purpose
X-Azure-FDID	Identifies Azure Front Door request
X-Forwarded-Host	Original requested host
X-Azure-ClientIP	Client IP address
X-Original-URL	Original request path
Authorization	JWT token passed to backend

---

Application Insights Checklist

When troubleshooting:

✅ Check Request Failures

✅ Check Exceptions

✅ Verify Response Codes

✅ Compare Front Door vs Direct Origin Requests

✅ Validate Authorization Header

✅ Review Authentication Events

✅ Inspect Dependency Calls

---

Key Takeaways

• Azure Front Door provides global routing, security, and performance improvements.

• A simple route configuration (/*) is sufficient for many App Service applications.

• Always validate both Front Door and direct App Service endpoints during troubleshooting.

• Application Insights should be the first place to inspect failures.

• Use X-Azure-FDID to confirm requests originate from Azure Front Door.

• Most authentication issues are caused by missing or invalid Authorization headers.

• HTTP-to-HTTPS redirects can lead to JWT authentication failures when clients do not preserve Authorization headers.

• Always use HTTPS URLs directly when testing secured APIs.

• Understanding request flow through Front Door dramatically simplifies troubleshooting.