You have an Application Gateway with WAF enabled. The gateway is configured to route traffic to its own URL, but accessing that URL returns HTTP 403 and diagnostics show WAF blocking. You propose adding a rewrite rule that changes the Host header. Will adding a rewrite rule for the Host header ensure the URL is accessible through the application gateway from any client IP?

Changing the Host header with a rewrite rule will not resolve a WAF 403 error caused by WAF blocking. WAF operates at a layer above header rewrites and inspects the request based on its rules, regardless of a modified Host header. The 403 indicates WAF detected a malicious pattern or policy violation in the request itself, not an issue with the Host header routing. To fix this, you need to identify which WAF rule is being triggered and either adjust the rule, create an exclusion, or modify the request to comply with WAF policies. Simply rewriting the Host header won't bypass the WAF's security inspection.