Max file upload vs Max request body size - Azure Application Gateway (2)

@NickJanssen Given the documentation of Microsoft, I'd say the recommended solution for Core Rule Set 3.2 is: disable the maximum request body limit.

For older Web Application Firewalls running Core Rule Set 3.1 (or lower), turning off the request body inspection allows for messages larger than 128 KB to be sent to Web Application Firewall, but the message body isn't inspected for vulnerabilities. For Policy Web Application Firewalls running Core Rule Set 3.2 (or newer), you can achieve the same outcome by disabling maximum request body limit. For Policy Web Application Firewalls running Core Rule Set 3.2 (or newer), you can achieve the same outcome by disabling maximum request body limit.

A couple of things to double-check:

• Are you running Application Gateway v2 Web Application Firewalls
• Are you running Core Rule Set 3.2 or later
• Have you indeed disabled the setting ‘Enforce maximum request body limit’? (see New Blog | Configuration of Size Enforcement and Inspection Limits in Application Gateway WAF - Microsoft Community Hub and below screenshot)

Will double-check with @Anne Buit, but assume the ‘solution’ to your ticket is you disabling the maximum request body limit and us updating our documentation.