Azure Application Gateway request header routing to different AppService slots

Question

Hello Guys,

I'm exploring Azure Application Gateway, reading documentation and other things but couldn't figure-out if that is really possible.

I have a mobile application with an API (a .NET 7 back-end) that is going to be deployed as Azure AppService with several deployment slots. My Azure AppService is not going to be exposed to DMZ directly - I'd like to use Azure Application Gateway instead.

I want my mobile app to send a request to Application Gateway supplying it's version as custom HTTP Header and Application Gateway to have a rule to route the traffic this way (for example):
If mobile app version is 1.0 then route to a default production slot (i.e. not changing anything), if it's 2.0 - route to a test slot (which has the same hostname but with "test" suffix).

Answer 1

Hi, thanks for your question at Q&A. I hope you are doing well. I understand that you want to know about the possibilities of routing requests based on a HTTP header in the request.

Application gateway features rewriting rules to rewrite requests to different backend URLs based on the URL, query parameters and headers. This documentation provides details on how to setup such rules.

Answer 2

@Oleksii Kovalchuk

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to redirect traffic to a staging slot of Azure AppService behind Application Gateway based on Request Header.

Please note that, as of now, Application gateway offers two ways for redirection,

• Listener Redirection
• Path-based Redirection to a different backend Pool
• Redirection to External Site

Also, you cannot add a staging slot as the backend Pool of an AppGw

• This means, you will have to use the IPAddress/FQDN of the staging slot instead of AppService in AppGw backend settings
• This also means that you have to manage the BackendSettings such as HostName, Probe and certificates incase of End-to-End TLS.

At this stage, I hope you can arrive at the complexity of the requirement.

The requirement is doable, but it will

• Require you to use Path-based routing, instead of Header-based routing or use a different URL and Listener altogether for the Staging environment's traffic
• For e.g., "/" ---> goes to default backend and "/staging/*" ---> goes to Staging backend.
• 
• URL path-based redirection

Now, for the HTTPSettings,

• In case you are using End-to-End SSL, and using default HostName, you can simply enable "Use well known CA certificate".
• However, if you are using a custom domain for the staging slot, you will be required to Add authentication/trusted root certificates of backend servers (same process as Production slot)

I hope I was able to summarize the key requirements and constraints related to this set-up.

Let us know should you have any additional queries.

Cheers,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members :)