Azure blob storage security options in MVC
asp.net-mvc, azure, azure-blob-storage, c#, security
Solution
If you are using a public container then you are not really restricting access to authenticated users.
If the spec said "only authenticated users should have access" then I personally would find using a public container to be unacceptable. SAS is not very hard - the libraries do most of the work.
BTW: the format to list the items in a container is: https://myaccount.blob.core.windows.net/mycontainer?restype=container&comp=list
Problem
I am working on a solution where a small number of authenticated users should have full access to a set of Azure Blob Storage containers. I have currently implemented a system with public access, and wonder if I need to complicate the system further, or if this system would be sufficiently secure. I have looked briefly into how Shared Access Signatures (SAS) works, but I am not sure if this really is necessary, and therefore ask for your insight. The goal is to allow only authenticated users to have full access to the blob containers and their content. The current system sets permissions in the following manner (C#, MVC): ``` // Retrieve a reference to my image container myContainer = blobClient.GetContainerReference("myimagescontainer"); // Create the container if it doesn't already exist if (myContainer.CreateIfNotExists()) { // Configure container for public access var permissions = myContainer.GetPermissions(); permissions.PublicAccess = BlobContainerPublicAccessType.Container; myContainer.SetPermissions(permissions); } ``` As a result, all blobs are fully accessible as long as you have the complete URL, but it does not seem to be possible to list the blobs in the container directly through the URL: ``` // This URL allows you to view one single image directly: 'https://mystorageaccount.blob.core.windows.net/mycontainer/mycontainer/image_ea644f08-3263-4a7f-9be7-bc42efbf8939.jpg' // These URLs appear to return to nothing but an error page: 'https://mystorageaccount.blob.core.windows.net/mycontainer/mycontainer/' 'https://mystorageaccount.blob.core.windows.net/mycontainer/' 'https://mystorageaccount.blob.core.windows.net/' ``` I do not find it an issue that authenticated users share complete URLs, allowing public access to a single image; however, no one but the authenticated users should be able to list, browse or access the containers directly to retrieve other images. My question then becomes whether I should secure the system further, for instance using SAS, when it right now appears to work as intended, or leave the system as-is. You might understand that I would like to not complicate the system if not strictly needed. Thanks! The solution I ended up using has been given below :)