Can I have multiple shared access signatures for a single file in azure blob storage?

Question

I have the situation where I want to send a link to a file with 3 months access to one user and send the same file with 1 month access to another user. Therefore I want to create two different SAS to the file.

Is this supported or every time I get a SAS to file it overwrites the previous?

Answer 1

A SAS is a token you generate based a set of policies/keys. Azure Storage (since you're using blobs), doesn't track these tokens server side. What happens is that when the SAS token is presented, it includes the "hashed" signature value and either the permission or the policy that was used to sign the request. The Storage service then re-computes the hash using the same keys that were used to generate the original hash and compares it to the signature value presented.

Because the tokens themselves are not tracked by the service, you can theoretically generate an infinite number of them.

Answer 2

The answer is yes. I have just uploaded one file and generated two different SAS - one expiring at 10:59 and the other at 11:10. At 11:00 the first one expired and "AuthenticationFailed" was returned on the given URL.

The start and end date-times are embedded in the SAS so that the obvious difference in time is carried with the URL and the system can see the difference.