Azure Web Sites – block web access to non-production deployment slots

Windows Azure Web Sites supports Staged Publishing functionality, which allows you to create a staging site slot where you can publish a new version of the website and then test it before swapping to the production environment. By default the non-production deployment slot has its own hostname that you use to test the bits deployed there. Sometimes, however you may want to prevent users from browsing to your non-production deployment slot while you are testing it.

It is relatively easy to configure your site to block the http request if it is deployed to any non-production slot. For example let’s say I have a site ruslany.azurewebsites.net and I created a deployment slot for it and name the slot as ‘staging‘ (it is possible to give custom names to deployment slots now). The hostname for that deployment slot will be ‘ruslany-staging.azurewebsites.net‘. So to prevent access to the deployment slot from anybody except a few allowed IP addresses I can add the following rewrite rule to my site’s web.config file:

<rule name="Block unauthorized traffic to staging sites" stopProcessing="true">
  <match url=".*" />
  <conditions>
<!-- Enter your staging site host name here as the pattern-->
    <add input="{HTTP_HOST}" pattern="^ruslany\-staging\." />
<!-- Enter your white listed IP addresses -->
    <add input="{REMOTE_ADDR}" pattern="123\.123\.123\.1" negate="true"/>
<!-- Add the white listed IP addresses with a new condition as seen below -->
<!-- <add input="{REMOTE_ADDR}" pattern="123\.123\.123\.2" negate="true"/> -->
  </conditions>
  <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Site is not accessible" />
</rule>

When the site with this rule is located in my staging slot any http request to it will be blocked with HTTP 403 response as long as it is not a request from a white-listed IP address in the rewrite rule. When the site is swapped into the production slot the rewrite rule will be no-op because the first rewrite condition will not match, so all http traffic will be allowed to the site.