I am using Azure Blob Storage in order to store files (mostly images) for my . NET application. In one part of the application, the user can attach an image to a report and save it. That will save the file and it will be under a url of the following form :
"https://{storageAccountName}.blob.core.windows.net/.../{exportPath}";
Afterwards, if the resulting url would be shared by the user, it could be used by anyone (without any authorization taking place) in order to download that image.
I would want to ensure that the files are accessible only within authorized users.
What should I do for such direct access links to externally stored resources where I can't calculate access authorization, so that my files won't be available to anyone with the azure blob link ?
I was reading up on documentation provided by Microsoft regarding Azure Blobs, mostly SAS ( so that I can make my files accessible only to authorized users) https://docs.microsoft.com/en-us/azure/storage/blobs/sas-service-create?tabs=dotnet https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-dotnet, but I haven't figured out yet if that's the way . ( also quick expiration token)
Thank You rickvdbosch for providing your suggestion in comment and I am converting as an answer to help other community member.
Make container as private and storing files there using either a Managed Identity or Access Token and SAS.
There are many ways you can protect your blob storage accessible from public.
Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory
Another way is SAS’s are basically a URI with query parameters that specify options such as the expiration time, permissions, and a signed signature. Using SAS Can control access to containers and blobs.
Reference : https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview