无法从 Java 下载 Azure blob

Question

This is a rather strange issue. I need to generate a signed url that can be shared with others for downloading the file within a certain time limit. Obviously, since I am saying signed, you should not require any prior permissions to download. Following is the code I am using to upload and download

  private final BlobSasPermission blobSasPermission = new BlobSasPermission()
      .setReadPermission(true);

  public String uploadAndGenerateSignedUrl(String filePath, String uploadPath) {
    BlobClient blobClient = containerClient.getBlobClient(uploadPath);
    blobClient.uploadFromFile(filePath);

    BlockBlobClient blockBlobClient = blobClient.getBlockBlobClient();
    BlobServiceSasSignatureValues blobServiceSasSignatureValues = new BlobServiceSasSignatureValues(
        OffsetDateTime.now().plusMinutes(azureConfiguration.getExpiryMin()), blobSasPermission);
    return blockBlobClient.getBlobUrl() + "?" + blockBlobClient
        .generateSas(blobServiceSasSignatureValues);
  }

  public void downloadFromUrl(String signedUrl, File file) throws IOException {
    OkHttpClient client = SharedClient.getNewSharedClientBuilder().build();

    Request request = new Request.Builder()
        .url(signedUrl)
        .build();

    okhttp3.Response response = client.newCall(request).execute();
    InputStream inputStream = response.body().byteStream();
    FileUtils.copyInputStreamToFile(inputStream, file);
  }

Now, when I open the generated url in the browser, the file is successfully downloaded. Similarly, running the GET in PostMan for this url, works fine. However, when I send the same url to the download method, it fails with error 403 stating Server failed to authenticate the request. I am clueless about the reason for this. I tried adding both http and https protocols to signed url but that also did not help.

Edit:

Adding the error message
Response{protocol=http/1.1, code=403, message=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature., url=https://{account}.blob.core.windows.net/{container}/MDConnector/MDTest/Test_16269425/2021-07-24/1627125196450/NormalFile.md?sv=2019-07-07&se=2021-07-24T12:13:18Z&sr=b&sp=r&sig=BoTaZ9iEA8Cdcbscf6zpWTol32+52rfVyLNDMBlLr1Q=}

Answer 1

I'm able to reproduce this issue. Essentially the issue is coming because of + sign in your SAS token signature. When a URL is created, + sign is interpreted as a space and because of that your authorization is failing.

What you have to do is URL encode your SAS token. Once you do that, your request should work just fine. Please see the sample code below:

package com.company;

import okhttp3.OkHttpClient;
import okhttp3.Request;

import java.io.IOException;
import java.io.InputStream;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

public class Main {

    public static void main(String[] args) throws IOException {
        String url = "https://account.blob.core.windows.net/container/blob.png";
        String sasToken = "sv=2020-04-08&st=2021-07-24T14:33:27Z&se=2021-07-31T14:33:00Z&sr=b&sp=rac&sig=QytPc/+0z/eHd+u4WO0HGOFDOZjVfB+vbQdbR6FFrl4=";//Notice the "+" sign in SAS token.
        sasToken = URLEncoder.encode(sasToken, StandardCharsets.UTF_8.toString());
        OkHttpClient client = new OkHttpClient();
        Request request = new Request.Builder().url(url+"?"+ sasToken).build();
        okhttp3.Response response = client.newCall(request).execute();
        InputStream inputStream = response.body().byteStream();
    }
}