Your Azure Front Door (Standard/Premium) protects an app with a WAF policy using the managed rule set. After enabling WAF, legitimate GraphQL POST requests are blocked by a SQL injection rule inspecting the JSON body field named query. You must keep SQL injection protection for other requests and also rate limit the login endpoint to 100 requests per minute. What should you do?

The correct solution addresses both problems effectively. Adding an exclusion for the specific JSON body argument query prevents false positives for legitimate GraphQL requests without disabling SQLi protection for other parts of the request or other requests entirely. This maintains strong security while allowing valid traffic. Creating a custom rate limit rule for /login with a higher priority ensures that the login endpoint is protected against brute-force attacks as required, overriding any less specific managed rules. Disabling the entire SQL injection rules group is too broad and significantly weakens security. Creating a custom rule to allow all POST requests is also too permissive and would bypass necessary WAF inspections. Increasing the WAF anomaly score threshold is a general adjustment that might reduce false positives but doesn't specifically address the GraphQL issue and doesn't provide the required rate limiting for the login endpoint.