Azure Blob 存儲 SAS 令牌未正確形成 .NET

Question

我正在嘗試生成 SaS 令牌以從 Azure Blob 存儲下載 Blob。 生成令牌並嘗試下載后，我遇到了以下錯誤：

Azure.RequestFailedException
  HResult=0x80131500
  Message=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:6127b736-401e-002d-7413-aeddd5000000
Time:2020-10-29T16:53:15.3700463Z
Status: 403 (Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.)
ErrorCode: AuthenticationFailed

這是 Azure 中儀表板生成的令牌：

sp=r&st=2020-10-29T16:59:18Z&se=2020-10-29T17:59:18Z&spr=https&sv=2019-12-12&sr=b&sig=KEXuzAqhUOxwvJeGAeCxJ%2BroF2D7VDnx%2BgM7ABuch%2Fs%3D

這是我生成的令牌：

sv=2019-12-12&spr=https&st=2020-10-29T16:53:51Z&se=2020-10-29T22:53:51Z&sr=b&sp=r&sig=RsVzWh/QlRtMTDUXtVVKJ3WAkCjrpr2CRXN1idEyWdc=

這是我用於生成令牌的代碼：

    private static Uri GetBlobSasUri(BlobContainerClient container,
                string blobName, StorageSharedKeyCredential key, string storedPolicyName = null)
    {
        // Create a SAS token that's valid for one hour.
        BlobSasBuilder sasBuilder = new BlobSasBuilder()
        {
            BlobContainerName = container.Name,
            BlobName = blobName,
            Resource = "b",
            Protocol = SasProtocol.Https,
        };

        if (storedPolicyName == null)
        {
            sasBuilder.StartsOn = DateTimeOffset.UtcNow;
            sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddHours(6);
            sasBuilder.SetPermissions(BlobContainerSasPermissions.Read);
        }
        else
        {
            sasBuilder.Identifier = storedPolicyName;
        }

        // Use the key to get the SAS token.
        BlobSasQueryParameters parameters = sasBuilder.ToSasQueryParameters(key);
        string sasToken = Uri.UnescapeDataString(parameters.ToString());

        Console.WriteLine("SAS for blob is: {0}", sasToken);
        Console.WriteLine();

        UriBuilder baseUri = new UriBuilder(container.GetBlockBlobClient(blobName).Uri);
        baseUri.Query = sasToken;

        return baseUri.Uri;
    }

Answer 1

我解決了這個問題。

1. 簽名需要 UrlEncoded
2. 我需要將 StartsOn 偏移量設置為DateTimeOffset.UtcNow.AddMinutes(-5)