07-30-2022, 09:44 PM
(This post was last modified: 07-30-2022, 09:47 PM by Alexandre Machado.)
Yes... I believe that this is the cause.
We have explicitly blocked empty user agent strings because there is no reason to allow them. Although UA string is not a required field in a HTTP(S) request, it is advisable (by W3C) to always set it in any request.
What I think you need to look into is if the load balancer is not forwarding the UA string received from a legitimate user (using a real browser), or if this request came from their health probe and then the Azure load balancer thinks that the application is not working.
After some investigation I found a post where a user complains that Azure health probe is not setting the UA string correctly. See here: https://github.com/MicrosoftDocs/azure-d...sues/69155
People on that thread seem to consider this as an Azure bug (and so do I).
The best way to deal with it is creating a session-less content handler to respond to all health probes requests regardless of the UA string. This will avoid that the health probe creates dozens (if not hundreds) of ghost sessions for no reason.
There is no reason for the health probe to send an empty UA either.
We have explicitly blocked empty user agent strings because there is no reason to allow them. Although UA string is not a required field in a HTTP(S) request, it is advisable (by W3C) to always set it in any request.
What I think you need to look into is if the load balancer is not forwarding the UA string received from a legitimate user (using a real browser), or if this request came from their health probe and then the Azure load balancer thinks that the application is not working.
After some investigation I found a post where a user complains that Azure health probe is not setting the UA string correctly. See here: https://github.com/MicrosoftDocs/azure-d...sues/69155
People on that thread seem to consider this as an Azure bug (and so do I).
The best way to deal with it is creating a session-less content handler to respond to all health probes requests regardless of the UA string. This will avoid that the health probe creates dozens (if not hundreds) of ghost sessions for no reason.
There is no reason for the health probe to send an empty UA either.