How to troubleshoot if a cookie is being sent to application gateway with each and every request

I would be careful assuming the full `Cookie` header will always be visible in Application Gateway logs. The WAF/firewall logs are excellent for showing which rule matched, the URI, transaction ID, action, and match details, but they are not a general-purpose packet capture of every request header value.

A practical way to prove this is:

1. Enable Application Gateway access logs and WAF logs to Log Analytics.

2. Correlate by `transactionId`, client IP, URI, and timestamp to identify the exact blocked request.

3. Add a temporary custom WAF rule that matches the expected cookie name/value with action `Log` or `Allow` in a non-production/test policy first. If that rule does not match but another rule blocks the request, the cookie condition likely was not present as expected.

4. Confirm at the edge of the application too: browser dev tools/Fiddler on the client and temporary backend logging of cookie presence only, not the full secret value.

5. Check cookie attributes such as `Domain`, `Path`, `Secure`, and `SameSite`; these often explain why a cookie is sent on some requests but not others.

Useful docs:

https://learn.microsoft.com/azure/web-application-firewall/ag/web-application-firewall-logs

https://learn.microsoft.com/troubleshoot/azure/web-application-firewall/web-application-firewall-troubleshoot

https://learn.microsoft.com/azure/web-application-firewall/ag/custom-waf-rules-overview