In our application we connect to a consumed rest api and need to execute a PUT operation to send binary contents. The consumed api service requires us to use multipart/form-data.
The requests we send out are blocked by the Azure firewall, because apparantly the requests violate OWASP CRS rule 920470.
Mendix support has investigated into this issue and found the following: "Azure currently handles the = character in the multipart boundary more strictly than expected, which causes it to block requests that are valid and can be sent by Mendix applications. Microsoft is aware of this issue but they have not fixed it so far."
I would like for Mendix to change how these requests are generated so that they are compatible with Azure's current and future validation.
The boundary part is generated as: ----=_Part_0_1979835990.1788509046961. If it would be generated as:
-----_Part_0_1979835990.1788509046961 there would be no issue.
Example of current implementation:
Request content for PUT request to https://api.*.nl HTTP/1.1
Authorization: (omitted)
Content-Type: multipart/form-data; boundary="----=_Part_0_1979835990.1788509046961"
------=_Part_0_1979835990.1788509046961
Content-Disposition: form-data; name="lock"
[lock]
------=_Part_0_1979835990.1788509046961
Content-Type: application/octet-stream
Content-Disposition: form-data; name="inhoud"; filename="filename.pdf"
[binary]
------=_Part_0_1979835990.1788509046961--