Azure Blob Store SAS token missing Service Resource field

Question

I created a Shared Access Signature(SAS) token on my Azure storage account using the web interface. The token looks like

?sv=xxxx-xx-xx&ss=b&srt=sco&sp=rl&se=xxxx-xx-xxTxx:xx:xxZ&st=xxxx-xx-xxTxx:xx:xxZ&spr=https&sig=xxxxxxxxxxxxxxxxxxxxxx

The SAS token here is missing the sr field for Service Resource. I have to manually prepend the sr=b to the query string to get things to work. I must be doing something wrong, because this seems extremely finicky.

from azure.storage.blob import BlockBlobService
sas_token = "?sv=xxxx-xx-xx&ss=b&srt=sco&sp=rl&se=xxxx-xx-xxTxx:xx:xxZ&st=xxxx-xx-xxTxx:xx:xxZ&spr=https&sig=xxxxxxxxxxxxxxxxxxxxxx"
sas_token = "?sr=b&" + sas_token[1:]

serv = BlockBlobService(account_name='myaccount', sas_token=sas_token)

for cont in serv.list_containers():
    print cont.name

Without the sas_token = "?sr=b&" + sas_token[1:] I get the error:

sr is mandatory. Cannot be empty

And if the sr=b field is not first in the query, I get an authentication error like

Access without signed identifier cannot have time window more than 1 hour

Aaron Chen Aaron Chen · Accepted Answer · 2017-07-07T08:30:08

Access without signed identifier cannot have time window more than 1 hour

Based on this error message, you may need to set expiry time less than 1 hour from now. See Windows Azure Shared Access Signature always gives: Forbidden 403.

I took your code with Python v2.7.12 and @azure-storage-python v0.34.3 (the latest version). And it worked well on my site. So, I'd recommend you upgrade to latest version and try it again.

UPDATE:

I traced the code of Azure Storage SDK for Python and here's what I found. The SDK is a REST API warpper which assumes that the SAS token looks like this:

sv=2015-04-05&ss=bfqt&srt=sco&sp=rl&se=2015-09-20T08:49Z&sip=168.1.5.60-168.1.5.70&sig=a39%2BYozJhGp6miujGymjRpN8tsrQfLo9Z3i8IRyIpnQ%3d

As you can see, the token doesn't include ?. And the SDK will append ? before the SAS token when it makes a GET request to the Azure Storage REST service.

This would cause that the key of the signed version was parsed as ?sv, then it raised the issue. So, to avoid this, we should remove the ? from the SAS token.

Azure Blob Store SAS token missing Service Resource field

1 Answers