Azure App Service rejected with 403 error by Storage Account

user_9479430 0
Viewed 1762

Our application server rejected by the storage account.

We generated the correct SAS token and we can reach the container in the local. (docker, intelliJ, postman)

  • WebbApp and the Storage Account are in the same location (Germany West Central UTC+2).
  • We have standard subsrciption/plan
  • We set containers to public.
  • We set IP address to firewall.
  • We use azure sdk java

We try to call the Blob service.

We got an error message when the app runs on the Azure servers.

com.azure.storage.blob.models.BlobStorageException at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance

If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:959d813f-601e-0057-262f-4351a4000000
Time:2021-05-07T10:53:45.0157340Z</Message></Error>"

Update https://i.stack.imgur.com/Hs2Cf.png

UPDATE

We set the time zone to UTC-0. It solved our problem. The serve run in UTC-0 time zone.

azure-storage-account azure-web-app-service azure-functions azure
2 Answers

There are two thing you should check:

  1. How you get this SAS token.
  2. Did you use different containers between local and remote.

As you said, you could use it successfully on local, then you could try debug you code to get the sas uri value, and access it directly by browser.

Finally, if it not help, you could try generate the SAS token from portal, and hard code the sas token to your code.

user_135860710

We set the time zone to UTC-0. It solved our problem. The serve run in UTC-0 time zone.

user_94794300
Related