# Azure Front Door with Azure App Service: A Practical Guide

## Introduction

Modern cloud applications require:

*   Low latency
    
*   High availability
    
*   Global routing
    
*   SSL termination
    
*   DDoS protection
    
*   Web Application Firewall (WAF)
    

Azure Front Door (AFD) is Microsoft's global application delivery service that routes user requests through Microsoft's edge network to the most appropriate backend service.

A typical architecture looks like:

```text
Users
   │
   ▼
Azure Front Door
   │
   ▼
Azure App Service
   │
   ▼
Database / APIs
```

### Benefits of Azure Front Door

*   Global load balancing
    
*   SSL offloading
    
*   Improved performance
    
*   Web Application Firewall integration
    
*   Origin health monitoring
    
*   Custom domain support
    
*   Path-based routing
    
*   Centralized ingress point for distributed applications
    

* * *

# Azure Front Door Fundamentals

Azure Front Door is a Layer-7 reverse proxy capable of routing HTTP and HTTPS traffic.

## Request Flow

```text
Browser / Client
       │
       ▼
Azure Front Door Endpoint
       │
       ▼
Route Matching
       │
       ▼
Origin Group
       │
       ▼
Origin (App Service)
```

## Core Components

### Endpoint

The public-facing DNS endpoint.

Example:

```text
mydiary-cud7d3eahthmcre9.z02.azurefd.net
```

* * *

### Route

Determines how incoming requests are matched and forwarded.

Examples:

```text
/*
```

```text
/api/*
```

* * *

### Origin Group

A collection of backend services.

Example:

```text
default-origin-group
```

Origin groups provide:

*   Failover capability
    
*   Health monitoring
    
*   Traffic distribution
    

* * *

### Origin

The actual backend service.

Example:

```text
slazmydiary01.azurewebsites.net
```

* * *

# Configuring Azure Front Door with App Service

## Step 1: Deploy App Service

Deploy your ASP.NET Core API.

Example:

```text
https://myapp.azurewebsites.net
```

Validate that endpoints work directly:

```text
GET /api/health
GET /api/expense
POST /api/auth/login
```

* * *

## Step 2: Create Azure Front Door

Create an Azure Front Door Standard or Premium profile.

Recommended for production:

```text
Azure Front Door Standard
```

* * *

## Step 3: Create an Origin Group

Example:

```text
app-origin-group
```

Recommended Health Probe Settings:

```text
Protocol: HTTPS
Path: /health
Interval: 30 seconds
```

* * *

## Step 4: Add App Service as Origin

Example configuration:

```text
Origin Type: App Service
Host Name: myapp.azurewebsites.net
HTTPS Port: 443
Origin Enabled: Yes
```

* * *

## Step 5: Configure Route

Recommended route configuration:

```text
Pattern to Match: /*
Origin Group: app-origin-group
Origin Path: Empty
Forwarding Protocol: Match Incoming Request
```

* * *

## Step 6: Enable HTTPS Redirection

Enable:

```text
Redirect all traffic to use HTTPS
```

This ensures:

*   Secure communication
    
*   Better security compliance
    
*   Prevention of accidental HTTP access
    

* * *

# Advanced Azure Front Door Features

## Custom Domains

Instead of:

```text
myapp.azurefd.net
```

Use:

```text
api.contoso.com
```

Benefits:

*   Branding
    
*   Easier management
    
*   Better user experience
    

* * *

## Web Application Firewall (WAF)

Protect applications from:

*   SQL Injection
    
*   Cross-Site Scripting (XSS)
    
*   Malicious Bots
    
*   OWASP Top 10 attacks
    

Architecture:

```text
Internet
    │
    ▼
Azure Front Door + WAF
    │
    ▼
App Service
```

* * *

## Path-Based Routing

Useful for microservices.

Example:

```text
/api/users/*      → User Service
/api/orders/*     → Order Service
/api/payments/*   → Payment Service
```

* * *

## Health Probes

Azure Front Door continuously checks backend health.

Example:

```text
GET /health
```

Benefits:

*   Automatic failover
    
*   Faster recovery
    
*   Improved reliability
    

* * *

## Caching

Ideal for:

```text
Images
CSS
JavaScript
Static Content
```

Avoid caching:

```text
JWT-secured APIs
Authenticated endpoints
User-specific data
```

* * *

## Private Link Integration

Available in Azure Front Door Premium.

Architecture:

```text
Internet
    │
    ▼
Azure Front Door
    │
    ▼
Private Link
    │
    ▼
App Service
```

Benefits:

*   Backend not publicly exposed
    
*   Improved security posture
    

* * *

# Security Best Practices

## Restrict Direct Backend Access

Validate requests originate from Front Door.

Example:

```csharp
var fdid = Request.Headers["X-Azure-FDID"];
```

Useful headers:

```http
X-Azure-FDID
X-Forwarded-Host
X-Azure-ClientIP
```

* * *

## Enforce HTTPS Everywhere

Always use:

```text
https://
```

Avoid:

```text
http://
```

for production APIs.

* * *

## Secure APIs Using JWT

Example:

```csharp
[Authorize]
[HttpGet("expense")]
public async Task<IActionResult> GetExpenses()
{
    ...
}
```

* * *

## Enable Application Insights

Monitor:

*   Failures
    
*   Dependency calls
    
*   Exceptions
    
*   Performance
    

* * *

# Troubleshooting Guide

## Scenario 1: 503 or 504 Errors

Symptoms:

```html
504 Gateway Timeout
```

### Check Origin Health

```text
Azure Front Door
    └─ Origin Group
          └─ Health Status
```

* * *

### Test Origin Directly

Test:

```text
https://myapp.azurewebsites.net/api/expense
```

If origin fails:

```text
Application issue
```

If origin succeeds:

```text
Front Door configuration issue
```

* * *

## Scenario 2: Route Misconfiguration

Example:

```text
Pattern = /api/auth/*
```

Works:

```text
/api/auth/login
```

Fails:

```text
/api/expense
```

Recommended:

```text
Pattern = /*
```

* * *

## Scenario 3: Authentication Failures (401)

Symptoms:

```http
401 Unauthorized
```

Investigate:

```csharp
OnAuthenticationFailed
OnTokenValidated
OnChallenge
```

Enable detailed logging.

* * *

## Scenario 4: Verify Request Came Through Front Door

Check headers:

```http
X-Azure-FDID
```

Example:

```text
X-Azure-FDID: fbadd70b-8340-48a6-a0c2-78830a17bdcf
```

Additional useful headers:

```http
X-Forwarded-Host
X-Original-URL
X-Azure-ClientIP
```

Example:

```text
X-Forwarded-Host: myapp.azurefd.net
X-Original-URL: /api/expense
```

* * *

## Scenario 5: Authorization Header Issues

Verify:

```csharp
Request.Headers["Authorization"]
```

Expected:

```text
Authorization: Bearer eyJ...
```

Missing authorization header typically causes:

```http
401 Unauthorized
```

* * *

## Scenario 6: HTTP to HTTPS Redirect and JWT Authentication

### Real-World Case Study

A Front Door route was configured with:

```text
Redirect all traffic to HTTPS = Enabled
```

Request:

```text
http://myapp.azurefd.net/api/expense
```

Flow:

```text
Client
   │
   ▼
HTTP Request + JWT
   │
   ▼
301 Redirect
   │
   ▼
HTTPS Request
```

Some HTTP clients may drop the Authorization header after following the redirect.

Result:

```http
401 Unauthorized
```

while the application itself remains healthy.

### Symptoms

Observed behavior:

```text
myapp.azurefd.net/api/expense
```

Failed

while

```text
https://myapp.azurefd.net/api/expense
```

Worked successfully.

### Root Cause

The request was initially sent over HTTP and redirected to HTTPS.

The Authorization header was not preserved during the redirect flow.

### Resolution

Always invoke APIs directly using HTTPS:

```text
https://myapp.azurefd.net/api/expense
```

Avoid:

```text
http://myapp.azurefd.net/api/expense
```

* * *

# Useful Diagnostic Headers

| Header | Purpose |
| --- | --- |
| X-Azure-FDID | Identifies Azure Front Door request |
| X-Forwarded-Host | Original requested host |
| X-Azure-ClientIP | Client IP address |
| X-Original-URL | Original request path |
| Authorization | JWT token passed to backend |

* * *

# Application Insights Checklist

When troubleshooting:

✅ Check Request Failures

✅ Check Exceptions

✅ Verify Response Codes

✅ Compare Front Door vs Direct Origin Requests

✅ Validate Authorization Header

✅ Review Authentication Events

✅ Inspect Dependency Calls

* * *

# Key Takeaways

*   Azure Front Door provides global routing, security, and performance improvements.
    
*   A simple route configuration (`/*`) is sufficient for many App Service applications.
    
*   Always validate both Front Door and direct App Service endpoints during troubleshooting.
    
*   Application Insights should be the first place to inspect failures.
    
*   Use `X-Azure-FDID` to confirm requests originate from Azure Front Door.
    
*   Most authentication issues are caused by missing or invalid Authorization headers.
    
*   HTTP-to-HTTPS redirects can lead to JWT authentication failures when clients do not preserve Authorization headers.
    
*   Always use HTTPS URLs directly when testing secured APIs.
    
*   Understanding request flow through Front Door dramatically simplifies troubleshooting.