Some customers get “403 Forbidden” when confirming their order on the shop

The MasterLinux shop is published behind the Application Gateway v2 agw-boutique-prod (group rg-boutique-reseau), protected by the WAF policy wafpol-boutique-prod (OWASP CRS 3.2). For three months, the WAF was in Detection mode: it logged without blocking.

Yesterday at 18:30, after the annual security audit, the security team asked to “harden the WAF”; change CHG-4410 was applied in the evening. This morning, customer service received 37 calls: when confirming the order (form POST /commande/valider), the page shows 403 Forbidden. The affected customers retried, changed browser, card… with no success. Others order normally.

The average basket is 640 dirhams and morning orders have dropped by 22%. The e-commerce manager wants a solution today, and security refuses to “remove the WAF”.

You are on your workstation with Azure CLI; the Log Analytics workspace law-masterlinux-prod (ID 4b7e2c19-0d8a-4f63-9e51-a2c6b8f3d074) receives the Application Gateway logs.