Azure / Azure/Azurite

Authentication fails if both date and both x-ms-date is specified

Open
#1,385 2 comments 0 reactions 1 assignee Claimed by @blueww View on GitHub
blob-storage bug
Dominant language
TypeScript
Stars
2.3k
Forks
393
Avg merge
1d 20h
Merged PRs (30d)
36

Description

### Which service(blob, file, queue, table) does this issue concern?
blob
### Which version of the Azurite was used?
V3
### Where do you get Azurite? (npm, DockerHub, NuGet, Visual Studio Code Extension)
DockerHub
### What's the Node.js version?

### What problem was encountered?
Authentication fails with 403

Auzre documentation mentions that if both "date:" and "x-ms-date:" is specified, one should construct the authentication string with an empty value for the Date header.

However, when my application construct the auth string with empty value for "date" authentication fails. This works with production storage account.

Please see the log for details
My application uses following string

HEAD HTTP/1.1
Host: 127.0.0.1
date: Thu, 10 Mar 2022 21:38:40 GMT
x-ms-date: Thu, 10 Mar 2022 21:38:40 GMT
x-ms-version: 2018-11-09

'HEAD\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container'

however, debug log shows that Azurite is using

HEAD\n\n\n\n\n\nThu, 10 Mar 2022 21:38:40 GMT\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container"
### Steps to reproduce the issue?
Set both date and x-ms-date but use only x-ms-date for authentication string.

#####If possible, please provide the debug log using the -d parameter, replacing \ with an appropriate path for your OS, or review the instructions for docker containers:
------------------------------------------------
2022-03-10T21:38:40.973Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobStorageContextMiddleware: RequestMethod=HEAD RequestURL=https://127.0.0.1/devstoreaccount1/mycontainer?restype=container RequestHeaders:{"host":"127.0.0.1","date":"Thu, 10 Mar 2022 21:38:40 GMT","x-ms-date":"Thu, 10 Mar 2022 21:38:40 GMT","x-ms-version":"2018-11-09","authorization":"SharedKey devstoreaccount1:Bq200mrekeSTUw8ai9VBoE0lgxqLHRuArcBTi0z51Cs="} ClientIP=172.17.0.1 Protocol=https HTTPVersion=1.1
2022-03-10T21:38:40.974Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobStorageContextMiddleware: Account=devstoreaccount1 Container=mycontainer Blob=
2022-03-10T21:38:40.974Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 verbose: DispatchMiddleware: Dispatching request...
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: DispatchMiddleware: Operation=Container_GetPropertiesWithHead
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 verbose: AuthenticationMiddlewareFactory:createAuthenticationMiddleware() Validating authentications.
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: PublicAccessAuthenticator:validate() Start validation against public access.
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Getting account properties...
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Retrieved account name from context: devstoreaccount1, container: mycontainer, blob:
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Skip public access authentication. Cannot get public access type for container mycontainer
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Start validation against account shared key authentication.
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() [STRING TO SIGN]:"HEAD\n\n\n\n\n\nThu, 10 Mar 2022 21:38:40 GMT\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container"
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Calculated authentication header based on key1: SharedKey devstoreaccount1:ZcI+nKZCm+260jInOhN6pldx2egt9NGnNfHpu3lUk5g=
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Validation failed.

----------------------------------------
Please be sure to remove any PII or sensitive information before sharing!
The debug log will log raw request headers and bodies, so that we can replay these against Azurite using REST and create tests to validate resolution.

### Have you found a mitigation/solution?
Modified the application to send only x-ms-date header and use it for authentication string.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.