Azure blob in ASP.NET MVC : signature fields not well formed

Question

Using the following code to generate SAS and attaching to blob url, it looks simple put unable to make it work

Dim sasUrl As String = imageUrl 'https://**blob.core.windows.net/mycontainer/site/GroupImages/Tabs/image.png
Dim blobSasBuilder As Azure.Storage.Sas.BlobSasBuilder = New Azure.Storage.Sas.BlobSasBuilder() With {
                                                                                        .BlobContainerName = _azContainerName,
                                                                                        .StartsOn = DateTime.UtcNow.AddMinutes(-30),
                                                                                        .ExpiresOn = DateTime.UtcNow.AddHours(1)
                                                                                    }
blobSasBuilder.SetPermissions(Sas.BlobSasPermissions.Read)
Dim sasToken = blobSasBuilder.ToSasQueryParameters(New StorageSharedKeyCredential(_azAccountName, _azAccountKey)).ToString()
sasUrl += "?" + sasToken

Return sasUrl

I get the following error:

AuthenticationFailed

Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

RequestId: 83ab7db1-501e-0043-6a84-f2ac67000000
Time: 2023-09-29T03:27:02.8112176Z

Signature fields not well formed.

Edit1 ::

Using exact same code and yet the same problem, only difference is my blob name is in canonical format, here is the change I have

Dim blobClient As BlobClient = _blobServiceClient.GetBlobContainerClient(_azCompanyContainerName).GetBlobClient("site/GroupImages/Tabs/pizza.png")

Dim blobSasBuilder As BlobSasBuilder = New BlobSasBuilder() With {
    .BlobContainerName = _azCompanyContainerName,
    .BlobName = "site/GroupImages/Tabs/pizza.png",
    .Resource = "b",
    .ExpiresOn = DateTimeOffset.UtcNow.AddHours(1),
    .Protocol = SasProtocol.Https
}

Edit 2::

Whenever there is a "+" in the token, it fails. Following is invalid one which throws above mentioned error,

sig=+Z9OWuihzHYWmdXToy53OS7y+PN2qtBPwhzgIYSsLTQ=

Answer 1

Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.RequestId: 83ab7db1-501e-0043-6a84-f2ac67000000 Time:2023-09-29T03:27:02.8112176Z Signature fields not well formed

The above error message indicates that the SAS token is not well-formed. This could be due to an issue with the way the SAS token is generated.

You can use the below code to generate a SAS token with a URL using vb.net.

Code.

Dim accountname As String = "xxxxx"
Dim accesskey As String = "xxxxxx"
Dim containername As String = "xxx"
Dim blobname As String = "xxxxx"
Dim credential As StorageSharedKeyCredential = New StorageSharedKeyCredential(accountname, accesskey)
Dim blobServiceClient As BlobServiceClient = New BlobServiceClient(New Uri($"https://{accountname}.blob.core.windows.net"), credential)
Dim blobClient As BlobClient = blobServiceClient.GetBlobContainerClient(containername).GetBlobClient(blobname)

' Create a BlobSasBuilder object
Dim blobSasBuilder As BlobSasBuilder = New BlobSasBuilder() With {
    .BlobContainerName = containername,
    .BlobName = blobname,
    .Resource = "b",
    .ExpiresOn = DateTimeOffset.UtcNow.AddHours(1),
    .Protocol = SasProtocol.Https
}
blobSasBuilder.SetPermissions(Sas.BlobSasPermissions.Read)
Dim sasToken = blobSasBuilder.ToSasQueryParameters(credential).ToString()
Dim uriBuilder As UriBuilder = New UriBuilder(blobClient.Uri)
uriBuilder.Query = sasToken
Dim blobsasURL As String = uriBuilder.Uri.ToString()
Console.WriteLine("SAS URL: " & blobsasURL)

Output:

SAS URL: https://venkat123.blob.core.windows.net/test1/bike.png?sv=2023-08-03&spr=https&se=2023-09-29T10%3A46%3A04Z&sr=b&sp=r&sig=xxxxxx

Copied the BLOB SAS URL and pasted it into the browser and it successfully displayed the image.

Browser:

Reference:

Create a service SAS for a blob with .NET - Azure Storage | Microsoft Learn