# Xhr search requests return 406 **URL:** https://meta.discourse.org/t/xhr-search-requests-return-406/147428 **Category:** Self-hosting **Created:** [April 9, 2020, 4:07pm UTC](https://meta.discourse.org/t/xhr-search-requests-return-406/147428 "2020-04-09T16:07:18Z") **Posts on this page:** 1 **Showing post:** 6
### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco) #### Post date: [April 9, 2020, 4:37pm UTC](https://meta.discourse.org/t/xhr-search-requests-return-406/147428/6 "2020-04-09T16:37:42Z")
Meta runs behind an AWS ALB reverse proxy and doesn’t exhibit this problem. Try runs behind an HAProxy reverse proxy and doesn’t exhibit this problem. Most self hosted instances only have the internal nginx reverse proxy and also doesn’t exhibit this problem. That makes me suspect the Azure Front Door. This won’t be the first time an Azure product has [weird broken behavior](https://meta.discourse.org/t/invalid-input-for-update-ip-address/77085/13). We also have experience with other WAF products breaking Discourse, so they aren’t supported. > [@Discourse + Web Application Firewall (WAF) mod\_security](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612/3): > > This is a bad idea and it is not recommended. The benefit of this type of thing for a JavaScript app is extremely limited and it adds significant complexity to your hosting setup. > [@Discourse + Web Application Firewall (WAF) mod\_security](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612/6): > > I think the desire for some magic device that auto mitigates issues is somewhat misguided in the Discourse setup. We have a bounty program, we patch issues in Discourse within hours of when they are reported. Sites run tests-passed by default which in today’s case contains commits from today. Sure if you are running software that was exploited years ago and you have no freedom to upgrade cause … reasons… a WAF makes sense cause it could save you. But in the case of Discourse I think it is at be… --- _[View the full topic](https://meta.discourse.org/t/xhr-search-requests-return-406/147428)._