@NickJanssen Given the documentation of Microsoft, I'd say the recommended solution for Core Rule Set 3.2 is: disable the maximum request body limit.

For older Web Application Firewalls running Core Rule Set 3.1 (or lower), turning off the request body inspection allows for messages larger than 128 KB to be sent to Web Application Firewall, but the message body isn't inspected for vulnerabilities. For Policy Web Application Firewalls running Core Rule Set 3.2 (or newer), you can achieve the same outcome by disabling maximum request body limit. For Policy Web Application Firewalls running Core Rule Set 3.2 (or newer), you can achieve the same outcome by disabling maximum request body limit.

A couple of things to double-check:

• Are you running Application Gateway v2 Web Application Firewalls
• Are you running Core Rule Set 3.2 or later
• Have you indeed disabled the setting ‘Enforce maximum request body limit’? (see New Blog | Configuration of Size Enforcement and Inspection Limits in Application Gateway WAF - Microsoft Community Hub and below screenshot)

Will double-check with @Anne Buit, but assume the ‘solution’ to your ticket is you disabling the maximum request body limit and us updating our documentation. 

Thanks Arie. We were running v2, but Core Rule Set 3.1. This version does not allow to use the request body inspection, while disabling the maximum request body limit.

By using Core Rule Set 3.2, we can disable the request body limit, but still make use of the request body inspection:

In Core Rule Set 3.1, you can only turn off both, which we do not want because of security reasons.

Thanks for the help!

@NickJanssen you are welcome! For clarity: have you indeed successfully uploading larger files after this recommended change?

Note: we do see the added value of fixing this in such a way that File uploads are not limited by the Maximum request body limit, but by the Maximum file upload size setting. However, this is quite a significant effort and not a priority just yet. 

So short-term recommendation is my answer above, we’ll make sure to update our Docs accordingly.

@Arie V we are currently testing it in our acceptation environment, but it certainly looks like we are able to do the uploads now. Thanks for the feedback.