Azure Blob SAS URL 403 issue

0
votes

I have a very weird issue with the azure blob. I have an Image container whose blob I am accessing using SAS URL.

"https://{storageName}.blob.core.windows.net/{container}/target_6ace5a78-83a9-4579-b348-2d0097aa1873/a85b8a1c-41c7-42f4-b8cb-a6389cd4cb2a?sp=rwdl&st=2019-02-14T10:25:00Z&=2020-02-16T10:25:00Z&sv=2018-03-28&sig={signatureKey}&sr=c"

When I am using the above URL in my browser its giving 403 but When I am modifying the above URL as below it's working fine. The only change is its now encode ie & is replaced with &

"https://{storageName}.blob.core.windows.net/{container}/target_6ace5a78-83a9-4579-b348-2d0097aa1873/a85b8a1c-41c7-42f4-b8cb-a6389cd4cb2a?sp=rwdl&st=2019-02-14T10:25:00Z&=2020-02-16T10:25:00Z&sv=2018-03-28&sig={signatureKey}&sr=c"

I am not able to understand the issue, because without encoded url also some of the other container SAS URL are working fine, but in this particular container why I need to have an encoded URL.?

1
azureazure-storage
You should always encode the Urls. If you encode them all do they all work? – Murray Foxcroft
I have not tested by encoded all the URLs for all the containers. but that is my question why I need to encode it, because SAS URL has generated without encoding and how come its working for rest of the container – Rahul Rai
Can you share the actual URL? – Gaurav Mantri
@GauravMantri I don't want to share on the public platform Can you suggest some way to share it? – Rahul Rai
You can email it to me - gmantri @ cerebrata.com and I will take a look. – Gaurav Mantri

1 Answers

1
votes

So the reason you're getting a 403 error in the first URL is because you're missing se parameter in your URL. If you change your URL to:

"https://{storageName}.blob.core.windows.net/{container}/target_6ace5a78-83a9-4579-b348-2d0097aa1873/a85b8a1c-41c7-42f4-b8cb-a6389cd4cb2a?sp=rwdl&st=2019-02-14T10:25:00Z&se=2020-02-16T10:25:00Z&sv=2018-03-28&sig={signatureKey}&sr=c"

Your request should work just fine.

Regarding why your 2nd URL is working is because the storage service is completely ignoring the query string as the blob container doesn't have a Private ACL. So if you just copy and paste the following URL:

"https://{storageName}.blob.core.windows.net/{container}/target_6ace5a78-83a9-4579-b348-2d0097aa1873/a85b8a1c-41c7-42f4-b8cb-a6389cd4cb2a"

You should see the the blob is downloading.