Azure / Azure/Azurite

SAS download returns 403

Open
#2,412 14 comments 1 reaction 2 assignees Claimed by @EmmaZhu View on GitHub
blob-storage bug
Dominant language
TypeScript
Stars
2.3k
Forks
393
Avg merge
1d 20h
Merged PRs (30d)
36

Description

### Which service(blob, file, queue, table) does this issue concern?
Blob
### Which version of the Azurite was used?
Tested in 3.28.0 from Visual Studio initially, tried upgrading to 3.30.0 with VS Code as well
### Where do you get Azurite? (npm, DockerHub, NuGet, Visual Studio Code Extension)
VS Code and Visual Studio 2022
### What's the Node.js version?
20.10.0
### What problem was encountered?
When trying to download file with a SAS token url, I get a 403 back from Azurite. Connecting to real storage account returns file as expected.
### Steps to reproduce the issue?
Tried azurite versions from Visual Studio and VS Code (version info above). Using oauth, https and fixed file location. Flags like so:

```
--location D:\azurite --oauth basic --cert D:\code\app\.cert\127-cert.pem --key D:\code\app\.cert\127-key.pem --skipApiVersionCheck -d D:\azurite\debug.log
```
Certificate is valid and I am able to use Azure Storage Explorer to connect and view the files in the instance

Using the Azure.Storage.Blobs SDK version 12.20.0, I have code like this:
```
UserDelegationKey key = await _blobServiceClient.GetUserDelegationKeyAsync(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddMinutes(5));
BlobSasBuilder sasBuilder = new()
{
BlobContainerName = containerName,
BlobName = fileName,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow,
ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(5)
};

sasBuilder.SetPermissions(BlobSasPermissions.Read);

string link = $"{_blobServiceUri}{containerName}/{fileName}?{sasBuilder.ToSasQueryParameters(key, _options.AccountName)}";
```
Generates a link that looks like this:
```
https://127.0.0.1:10000/devstoreaccount1/0cd6b12f-2c13-4953-9b13-33fa412d9733/test.png?skt=2024-06-11T16%3A02%3A10Z&ske=2024-06-11T16%3A07%3A10Z&sks=b&skv=2023-11-03&sv=2024-05-04&st=2024-06-11T16%3A02%3A12Z&se=2024-06-11T16%3A07%3A12Z&sr=b&sp=r&sig=lbKCvP0XQ4avTPVi%2FPIea8h3SByi6NBFgm8PqjF436Y%3D
```

When connected to Azurite, I get a 403 back. Connected to a real storage account, the file downloads as expected (confirmed in an incognito browser window).

I attached the debug.log, looks like it fails on validating the UDK?

[azurite-debug.log](https://github.com/user-attachments/files/15793321/azurite-debug.log)

### Have you found a mitigation/solution?
No, nothing I have done locally seems to work.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.