feat: Restrict backend Container App access in WAF deployment#939
Merged
Roopan-Microsoft merged 2 commits intodev-v4from Apr 22, 2026
Merged
Conversation
Prajwal-Microsoft
requested review from
Avijit-Microsoft,
Fr4nc3,
Roopan-Microsoft,
Vinay-Microsoft,
aniaroramsft,
dgp10801,
marktayl1,
nchandhi and
toherman-msft
as code owners
Prajwal-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
When enablePrivateNetworking (WAF mode) is active: Infrastructure: - Set Container App Environment to internal with public access disabled - Create private DNS zone for the CAE default domain linked to VNet - Add wildcard A record pointing to CAE static IP for DNS resolution - Frontend App Service gets PROXY_API_REQUESTS=true env var Frontend: - FastAPI server proxies /api/* requests to backend via httpx over VNet - /config endpoint returns same-origin /api URL in WAF mode - Added httpx dependency Post-deploy scripts: - Detect internal ingress / IP restrictions / PROXY_API_REQUESTS - Route API calls through frontend App Service proxy Non-WAF deployments remain unchanged. Resolves AB#39249 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prajwal-Microsoft
force-pushed
the
feature/39249-waf-api-private-access-clean
branch
from
b13a2bb to
e92c2d0
Compare
Prajwal-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
The frontend proxy only handled HTTP requests but MACAE uses WebSocket connections for real-time agent streaming. Add a WebSocket proxy route that forwards wss:// connections to the private backend Container App over the VNet using the websockets library. Also fix Dockerfile BuildKit --mount issue for ACR Task builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prajwal-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
Kamini-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Kamini-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
Roopan-Microsoft
approved these changes
Apr 22, 2026
Prajwal-Microsoft
deleted the
feature/39249-waf-api-private-access-clean
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
When
enablePrivateNetworking(WAF mode) is active, the backend Container App URL should not be exposed to the browser. This PR adds an application-layer proxy so the browser only communicates with the frontend App Service.Changes
Infrastructure (
infra/main.bicep&infra/main_custom.bicep):PROXY_API_REQUESTSenv var to frontend App Service (truein WAF mode)Frontend (
src/App/):frontend_server.py: Addedhttpx-based reverse proxy for/api/*routes./configreturns same-origin/apiURL in WAF mode so the browser never sees the Container App URLrequirements.txt: AddedhttpxdependencyPost-deploy scripts:
PROXY_API_REQUESTSsetting) and route API calls through the frontend proxyArchitecture (WAF mode)
Non-WAF deployments are unchanged — browser calls backend directly.
Resolves AB#39249
Does this introduce a breaking change?
How to Test
Deploy with WAF parameters and verify:
/configreturns{"API_URL":"/api"}(same-origin)What to Check
Other Information
Related PRs: microsoft/customer-chatbot-solution-accelerator#173, microsoft/Conversation-Knowledge-Mining-Solution-Accelerator#861
Replaces PR #904 (which had unrelated merge commits from dev-v4)