Secure Access to Azure Storage Blobs
Tags: azure, blobstorage, dotnet, csharp
Published: 2024-04-28 20:50:27

---
title: Secure Access to Azure Storage Blobs
published: true
date: 2024-04-28 16:40:25 UTC
tags: #azure #blobstorage #dotnet #csharp
canonical_url: https://www.kiss-code.com/blog/secure-access-to-azure-storage-blobs-28-04-2024
cover_image: https://brandwebsiteblobstore.blob.core.windows.net/images/ead761e5-1548-42f8-91be-a932262be70d.png
---

TLDR: [video](https://youtu.be/_xCF_BBjqQg)

In the midst of building a webshop-like feature for the [kiss-code.com](https://www.kiss-code.com/) brand website, I stumbled upon the requirement to provide **protected access** to the **digital products**.

Currently, my shop only holds the [lead magnet](https://www.kiss-code.com/products) which is **free**. Within 5 minutes after ordering it, you should receive an email containing a download link. This lead magnet lives on an Azure Blob Storage container which allows **public read access** for anyone to download, at any time.

This download link getting leaked would result in people bypassing subscribing to my newsletter. So, let's start by changing the access level to private.

![Change access level](https://brandwebsiteblobstore.blob.core.windows.net/images/209c242d2938-blob-access-level.png)

Surprise! Changing the access level to **private** will deny access also to the people who should have access after subscribing. Now, we can generate **Shared Access Signature (SAS) tokens** to grant limited access for a limited time. We can simply generate one by specifying permissions and the token's time-to-live (expiry) and clicking that "Generate SAS token and URL" button.

![Generate SAS](https://brandwebsiteblobstore.blob.core.windows.net/images/355fc01e50eb-generate-sas.png)

This results in the following token and URL. Following that URL will download the lead magnet which lives in a **private** Azure Blob Storage container.

![Generate SAS result](https://brandwebsiteblobstore.blob.core.windows.net/images/719444ad70d7-generate-sas-result.png)

Now, I'll want to generate these URLs **automatically** after someone ordered a digital product on my shop. So that this person receives an email containing the download link including the SAS token to **access** the **purchased product**.

I'll add the following code to my [NuGet package](https://www.nuget.org/packages/AugusteVN.Azure.BlobStorage/) to generate an URL including a SAS token that grants **read access** for a given duration.

```csharp
public string GenerateSasUrlForBlob(string blobName, DateTimeOffset? expiresOn = null, string? containerName = null)
{
    ArgumentNullException.ThrowIfNullOrWhiteSpace(_config.AccountKey);
    
    containerName = string.IsNullOrWhiteSpace(containerName) ? _config.ContainerName : containerName;
    ArgumentNullException.ThrowIfNullOrWhiteSpace(containerName);
    
    var sasBuilder = new BlobSasBuilder
    {
        BlobName = blobName,
        BlobContainerName = containerName,
        ExpiresOn = expiresOn ?? DateTimeOffset.UtcNow.AddHours(24)
    };
    
    sasBuilder.SetPermissions(BlobSasPermissions.Read);

    var sasUrl = sasBuilder
        .ToSasQueryParameters(new StorageSharedKeyCredential(_config.AccountName, _config.AccountKey))
        .ToString();
    
    return sasUrl;
}

```

You can get an `AccountKey` in the Azure portal:

![Account key](https://brandwebsiteblobstore.blob.core.windows.net/images/793e8e021dbe-account-key.png)

* * *

Find my [.NET 8 Brand Website V1](https://www.patreon.com/kisstupid/shop/net-8-brand-website-with-markdown-blog-33850) with tons of features add value to and capture your audience!

If you are interested in more of my work, you can find it:

- on my website: [kiss-code.com/products](https://www.kiss-code.com/products)
- on my [Patreon](https://www.patreon.com/kisstupid)
- on [YouTube](https://www.youtube.com/@kis.stupid)

Thank you for taking the time & interest in my work. Kind regards, Auguste @ [kiss-code.com](https://www.kiss-code.com)

* * *

Sources

- https://learn.microsoft.com/en-us/azure/storage/common/storage-account-sas-create-dotnet#create-an-account-sas
- https://www.c-sharpcorner.com/article/how-to-generate-sas-token-and-view-url-for-azure-blob-storage-in-blazor-apps-wit/