我如何确定 SAS 令牌是否已针对 Azure Blob 存储容器访问过期？

Question

我使用Azure Blob Storage Client Libary v11 for.Net 。

我写了一个程序，我们的客户可以用它来上传文件。 我为我们的客户生成了一个带有 SAS 令牌（有效期为 x 天）的 URL，客户可以使用该程序上传文件。 这是一个示例 url：

https://storage.blob.core.windows.net/123456789?sv=2019-07-07&sr=c&si=mypolicy&sig=ASDH845378ddsaSDdase324234234rASDSFR

如何在上传开始前判断 SAS token 是否仍然有效？

更新：

我在我的url中没有声明。这是我生成 url 的代码：

     var policyName = "mypolicy";

     string containerName = "123456789";

     // Retrieve storage account information from connection string
     CloudStorageAccount storageAccount = CloudStorageAccount.Parse(GetSecret());

     // Create a blob client for interacting with the blob service.
     CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();

     // Create a container for organizing blobs within the storage account.
     CloudBlobContainer container = blobClient.GetContainerReference(containerName);
     try
     {
        // The call below will fail if the sample is configured to use the storage emulator in the connection string, but 
        // the emulator is not running.
        // Change the retry policy for this call so that if it fails, it fails quickly.
        BlobRequestOptions requestOptions = new BlobRequestOptions() { RetryPolicy = new NoRetry() };
        await container.CreateIfNotExistsAsync(requestOptions, null);
     }
     catch (StorageException ex)
     {
        MessageBox.Show(ex.Message, Application.ProductName, MessageBoxButtons.OK, MessageBoxIcon.Error);
        return string.Empty;
     }

     // create the stored policy we will use, with the relevant permissions and expiry time
     var storedPolicy = new SharedAccessBlobPolicy()
     {
        SharedAccessExpiryTime = DateTime.UtcNow.AddDays(7),
        Permissions = SharedAccessBlobPermissions.Read |
                       SharedAccessBlobPermissions.Write |
                       SharedAccessBlobPermissions.List
     };

     // get the existing permissions (alternatively create new BlobContainerPermissions())
     var permissions = container.GetPermissions();

     // optionally clear out any existing policies on this container
     permissions.SharedAccessPolicies.Clear();
     // add in the new one
     permissions.SharedAccessPolicies.Add(policyName, storedPolicy);
     // save back to the container
     container.SetPermissions(permissions);

     // Now we are ready to create a shared access signature based on the stored access policy
     var containerSignature = container.GetSharedAccessSignature(null, policyName);
     // create the URI a client can use to get access to just this container

     return container.Uri + containerSignature;

Answer 1

我将Azure Blob 存储客户端库 v11 用于 .Net 。

我编写了一个程序，我们的客户可以使用它来上传文件。 我为我们的客户生成了一个带有 SAS 令牌（有效期为 x 天）的 URL，客户可以使用该程序上传文件。 这是一个示例网址：

https://storage.blob.core.windows.net/123456789?sv=2019-07-07&sr=c&si=mypolicy&sig=ASDH845378ddsaSDdase324234234rASDSFR

如何在开始上传之前确定 SAS 令牌是否仍然有效？

更新：

我的网址中没有se声明。 这是我生成网址的代码：

     var policyName = "mypolicy";

     string containerName = "123456789";

     // Retrieve storage account information from connection string
     CloudStorageAccount storageAccount = CloudStorageAccount.Parse(GetSecret());

     // Create a blob client for interacting with the blob service.
     CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();

     // Create a container for organizing blobs within the storage account.
     CloudBlobContainer container = blobClient.GetContainerReference(containerName);
     try
     {
        // The call below will fail if the sample is configured to use the storage emulator in the connection string, but 
        // the emulator is not running.
        // Change the retry policy for this call so that if it fails, it fails quickly.
        BlobRequestOptions requestOptions = new BlobRequestOptions() { RetryPolicy = new NoRetry() };
        await container.CreateIfNotExistsAsync(requestOptions, null);
     }
     catch (StorageException ex)
     {
        MessageBox.Show(ex.Message, Application.ProductName, MessageBoxButtons.OK, MessageBoxIcon.Error);
        return string.Empty;
     }

     // create the stored policy we will use, with the relevant permissions and expiry time
     var storedPolicy = new SharedAccessBlobPolicy()
     {
        SharedAccessExpiryTime = DateTime.UtcNow.AddDays(7),
        Permissions = SharedAccessBlobPermissions.Read |
                       SharedAccessBlobPermissions.Write |
                       SharedAccessBlobPermissions.List
     };

     // get the existing permissions (alternatively create new BlobContainerPermissions())
     var permissions = container.GetPermissions();

     // optionally clear out any existing policies on this container
     permissions.SharedAccessPolicies.Clear();
     // add in the new one
     permissions.SharedAccessPolicies.Add(policyName, storedPolicy);
     // save back to the container
     container.SetPermissions(permissions);

     // Now we are ready to create a shared access signature based on the stored access policy
     var containerSignature = container.GetSharedAccessSignature(null, policyName);
     // create the URI a client can use to get access to just this container

     return container.Uri + containerSignature;

Answer 2

我自己找到了解决办法。 这篇博客描述了两种不同的 ShardedAccessSignatures。 我修改了代码，现在我的 URL 中也有 se 声明。

解决方案：

    protected void GetSharedAccessSignature(
   String containerName, String blobName)
{
    CloudStorageAccount cloudStorageAccount =
       CloudStorageAccount.FromConfigurationSetting(“DataConnectionString”);
    CloudBlobClient cloudBlobClient = cloudStorageAccount.CreateCloudBlobClient();
    CloudBlobContainer cloudBlobContainer =
       new CloudBlobContainer(containerName, cloudBlobClient);
    CloudBlockBlob cloudBlockBlob =
         cloudBlobContainer.GetBlockBlobReference(blobName);
    SharedAccessPolicy sharedAccessPolicy = new SharedAccessPolicy();
    sharedAccessPolicy.Permissions = SharedAccessPermissions.Read;
    sharedAccessPolicy.SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-10);
    sharedAccessPolicy.SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(40);
    String sharedAccessSignature1 =
        cloudBlockBlob.GetSharedAccessSignature(sharedAccessPolicy);
    String sharedAccessSignature2 =
       cloudBlockBlob.GetSharedAccessSignature( new SharedAccessPolicy(), “adele”);
}

sharedAccessSignature1 包含 se 声明。 在我最初的问题代码中，我使用了 sharedAccessSignature2。