{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "slug": "dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test", "url": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/" }, "title": "Include session-affinity traffic in an Application Gateway draining test", "summary": "Check what happens to established sessions when a backend leaves the pool.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:54+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 200, "potentially_affected": "Use this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway's affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.", "dse_recommendation": "DSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client.", "primary_source": { "name": "Azure Application Gateway Backend Settings configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Application Gateway connection draining normally stops new requests to a deregistering backend while retaining existing connections until the configured timeout. Microsoft documents an exception: gateway-managed session affinity can continue sending requests to that backend. A gateway configuration update can also terminate ongoing connections when the draining timeout expires. Microsoft Learn.

\n

Applicability

\n

Use this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway’s affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.

\n

DSE recommendation

\n

DSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client. Agree when the application team can shut down the removed backend. Choose the draining interval against the actual transfer requirement and current source limits, and retain a way to restore the approved backend membership if the rehearsal fails.

\n

Verification

\n

During an approved rehearsal, send those three traffic patterns while removing one test backend. Correlate request destinations and transfer completion with removal and timeout timestamps. Repeat the relevant configuration-update case. Record any request still reaching the old backend before declaring it ready for shutdown.

\n

Official references

\n

Microsoft Learn: Azure Application Gateway Backend Settings configuration.

", "content_text": "Source facts\nApplication Gateway connection draining normally stops new requests to a deregistering backend while retaining existing connections until the configured timeout. Microsoft documents an exception: gateway-managed session affinity can continue sending requests to that backend. A gateway configuration update can also terminate ongoing connections when the draining timeout expires. Microsoft Learn.\nApplicability\nUse this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway’s affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.\nDSE recommendation\nDSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client. Agree when the application team can shut down the removed backend. Choose the draining interval against the actual transfer requirement and current source limits, and retain a way to restore the approved backend membership if the rehearsal fails.\nVerification\nDuring an approved rehearsal, send those three traffic patterns while removing one test backend. Correlate request destinations and transfer completion with removal and timeout timestamps. Repeat the relevant configuration-update case. Record any request still reaching the old backend before declaring it ready for shutdown.\nOfficial references\nMicrosoft Learn: Azure Application Gateway Backend Settings configuration.", "content_markdown": "## Source facts\n\nApplication Gateway connection draining normally stops new requests to a deregistering backend while retaining existing connections until the configured timeout. Microsoft documents an exception: gateway-managed session affinity can continue sending requests to that backend. A gateway configuration update can also terminate ongoing connections when the draining timeout expires. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings).\n\n## Applicability\n\nUse this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway’s affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.\n\n## DSE recommendation\n\nDSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client. Agree when the application team can shut down the removed backend. Choose the draining interval against the actual transfer requirement and current source limits, and retain a way to restore the approved backend membership if the rehearsal fails.\n\n## Verification\n\nDuring an approved rehearsal, send those three traffic patterns while removing one test backend. Correlate request destinations and transfer completion with removal and timeout timestamps. Repeat the relevant configuration-update case. Record any request still reaching the old backend before declaring it ready for shutdown.\n\n## Official references\n\n[Microsoft Learn: Azure Application Gateway Backend Settings configuration](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "url": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include session-affinity traffic in an Application Gateway draining test", "item": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "url": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/", "headline": "Include session-affinity traffic in an Application Gateway draining test", "description": "Check what happens to established sessions when a backend leaves the pool.", "abstract": "Check what happens to established sessions when a backend leaves the pool.", "articleBody": "Source facts\nApplication Gateway connection draining normally stops new requests to a deregistering backend while retaining existing connections until the configured timeout. Microsoft documents an exception: gateway-managed session affinity can continue sending requests to that backend. A gateway configuration update can also terminate ongoing connections when the draining timeout expires. Microsoft Learn.\nApplicability\nUse this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway’s affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.\nDSE recommendation\nDSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client. Agree when the application team can shut down the removed backend. Choose the draining interval against the actual transfer requirement and current source limits, and retain a way to restore the approved backend membership if the rehearsal fails.\nVerification\nDuring an approved rehearsal, send those three traffic patterns while removing one test backend. Correlate request destinations and transfer completion with removal and timeout timestamps. Repeat the relevant configuration-update case. Record any request still reaching the old backend before declaring it ready for shutdown.\nOfficial references\nMicrosoft Learn: Azure Application Gateway Backend Settings configuration.", "datePublished": "2026-09-17T16:34:54+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include session-affinity traffic in an Application Gateway draining test" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 200, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Application Gateway Backend Settings configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings" } } ] } }