How can i determine if a SAS Token has already expired for Azure Blob Storage Container Access?

Question

i use Azure Blob Storage Client Libary v11 for .Net.

I wrote a program that our customers can use to upload files. I generate a URL with a SAS Token (valid for x Days) for our customer and the customer can upload files using the program. Here is an example url:

https://storage.blob.core.windows.net/123456789?sv=2019-07-07&sr=c&si=mypolicy&sig=ASDH845378ddsaSDdase324234234rASDSFR

How can I find out whether the SAS token is still valid before the upload is started?

Update:

I have no se claim in my url. Here is my code to generate the url:

     var policyName = "mypolicy";

     string containerName = "123456789";

     // Retrieve storage account information from connection string
     CloudStorageAccount storageAccount = CloudStorageAccount.Parse(GetSecret());

     // Create a blob client for interacting with the blob service.
     CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();

     // Create a container for organizing blobs within the storage account.
     CloudBlobContainer container = blobClient.GetContainerReference(containerName);
     try
     {
        // The call below will fail if the sample is configured to use the storage emulator in the connection string, but 
        // the emulator is not running.
        // Change the retry policy for this call so that if it fails, it fails quickly.
        BlobRequestOptions requestOptions = new BlobRequestOptions() { RetryPolicy = new NoRetry() };
        await container.CreateIfNotExistsAsync(requestOptions, null);
     }
     catch (StorageException ex)
     {
        MessageBox.Show(ex.Message, Application.ProductName, MessageBoxButtons.OK, MessageBoxIcon.Error);
        return string.Empty;
     }

     // create the stored policy we will use, with the relevant permissions and expiry time
     var storedPolicy = new SharedAccessBlobPolicy()
     {
        SharedAccessExpiryTime = DateTime.UtcNow.AddDays(7),
        Permissions = SharedAccessBlobPermissions.Read |
                       SharedAccessBlobPermissions.Write |
                       SharedAccessBlobPermissions.List
     };

     // get the existing permissions (alternatively create new BlobContainerPermissions())
     var permissions = container.GetPermissions();

     // optionally clear out any existing policies on this container
     permissions.SharedAccessPolicies.Clear();
     // add in the new one
     permissions.SharedAccessPolicies.Add(policyName, storedPolicy);
     // save back to the container
     container.SetPermissions(permissions);

     // Now we are ready to create a shared access signature based on the stored access policy
     var containerSignature = container.GetSharedAccessSignature(null, policyName);
     // create the URI a client can use to get access to just this container

     return container.Uri + containerSignature;

Answer 1

I have found a solution myself. This blog describes two different ShardedAccessSignatures. I have adapted the code so that I now also have the se claim in my URL.

Solution:

    protected void GetSharedAccessSignature(
   String containerName, String blobName)
{
    CloudStorageAccount cloudStorageAccount =
       CloudStorageAccount.FromConfigurationSetting(“DataConnectionString”);
    CloudBlobClient cloudBlobClient = cloudStorageAccount.CreateCloudBlobClient();
    CloudBlobContainer cloudBlobContainer =
       new CloudBlobContainer(containerName, cloudBlobClient);
    CloudBlockBlob cloudBlockBlob =
         cloudBlobContainer.GetBlockBlobReference(blobName);
    SharedAccessPolicy sharedAccessPolicy = new SharedAccessPolicy();
    sharedAccessPolicy.Permissions = SharedAccessPermissions.Read;
    sharedAccessPolicy.SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-10);
    sharedAccessPolicy.SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(40);
    String sharedAccessSignature1 =
        cloudBlockBlob.GetSharedAccessSignature(sharedAccessPolicy);
    String sharedAccessSignature2 =
       cloudBlockBlob.GetSharedAccessSignature( new SharedAccessPolicy(), “adele”);
}

The sharedAccessSignature1 contains the se claim. In my code of my initial questions I had used the sharedAccessSignature2.