[BUG] SAS Signature fields not well formed

[kirankbs]

Describe the bug
BLOB resource is uploaded.
Appending SAS query parameters generated by library to BLOB URL causes the request to fail.

Exception or Stack Trace

AuthenticationFailed

Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:485024e3-301e-0001-07c3-b151e6000000 Time:2019-12-13T14:42:24.2855114Z

Signature fields not well formed.

To Reproduce
Using generated SAS token causes intermittent failures.

1. generate SAS query parameters.
2. append to blob url
3. Try to access the resource with the signed url.

Code Snippet
library dependency: "com.azure" % "azure-storage-blob" % "12.1.0"

1. Generate SAS quary params:
   new BlobServiceSasSignatureValues()
   .setExpiryTime(now().plusDays(conf.urlExpirationDays).toOffsetDateTime)
   .setPermissions(new BlobSasPermission().setReadPermission(true))
   .setContainerName(conf.container)
   .setBlobName(key)
   .generateSasQueryParameters(userDelegationKey(conf.urlExpirationDays), conf.storageAccount)
   .encode()
2. upload resource to blob
3. blockBlobClient.getBlobUrl + s"?$sharedAccessSignature"

Expected behavior
Every time the generated blob URL with SAS signature should be accessible

Additional context

I already checked below merged issues but did not help:

• Test Enhancements and General Fixes #6168
• Fixed issue where account SAS does not work on clients #6601

I observed some pattern for working url's and not working url's. the difference is only with sig parameter. not working one has + character in them.

Not Working:

sig=HnFiNxSp0BSvS+eg+bf5wHxOmxQJaPVqnqs81D+N6Eo=
sig=16TuQ7fhMNanms7x5W%2Fg+NzCRLfseDFDgB88rmb+XjU=
sig=8qgQKxaVnl0nUxX15bRt4VG7yxc7+Ppf9PqsPsxq5rE=
sig=Zfi3rhFiaD1zpY76kWIqRzJQ3Bl77%2F1b2DheP0wyN+E=
sig=Zfi3rhFiaD1zpY76kWIqRzJQ3Bl77%2F1b2DheP0wyN+E=
sig=D+EM63VkJc9wywZMH0sENjQVAHW8tiuCYbBMFeGfle4=
sig=OWVAzg0wAeS3r1MzIZkn+l8SbGKbKPrhjwa%2FdWbmoi8=
sig=q9+nQ1GSGWye9b318AJpFHHLWq4L0KQJzfazwku4MoM=
sig=v+w6XJSTzt%2FLvfNi7%2Flyy2hXMLI7AUgQ7e36BnYIDEc=

Working:
sig=r6GMuEPjB0dnxGHuGOX0F2ze3401ewntxK9T8JY%2FokA=
sig=IBzeKJBjnIN7vneV7JzhY8ZaqQKYD299rcj6i%2FecXGY=

[rickle-msft]

Hi, @kirankbs thank you for reporting this issue.

@gapra-msft Can you please take a look at this and see if this is still an issue after your changes to sas?

[gapra-msft]

Hi @kirankbs

Could you please try URL encoding the SAS token before appending it to your blob URL and let me know if that fixes this issue?

[kirankbs]

Hi @gapra-msft

I already called encode method as mentioned in code snippet. Here is again

Generate SAS quary params:
new BlobServiceSasSignatureValues()
.setExpiryTime(now().plusDays(conf.urlExpirationDays).toOffsetDateTime)
.setPermissions(new BlobSasPermission().setReadPermission(true))
.setContainerName(conf.container)
.setBlobName(key)
.generateSasQueryParameters(userDelegationKey(conf.urlExpirationDays), conf.storageAccount)
.encode()
```.

Please correct me!

[gapra-msft]

Hi @kirankbs, Sorry it looks like my response was a little confusing. Could you please replace the + in your signature of the SAS with a %2B?

I am trying to reproduce the issue but I'm not able to generate a SAS with a + in it so far. I'll continue trying. Thank you for your patience!

[kirankbs]

@gapra-msft Thank you. Below are the steps I re-tried:

1. Generated SAS query parameters string from below snippet:

new BlobServiceSasSignatureValues()
.setExpiryTime(now().plusDays(conf.urlExpirationDays).toOffsetDateTime)
.setPermissions(new BlobSasPermission().setReadPermission(true))
.setContainerName(conf.container)
.setBlobName(key)
.generateSasQueryParameters(userDelegationKey(conf.urlExpirationDays), conf.storageAccount)
.encode()

2. Applied encoding(UTF-8) to generated SAS query parameters string.

Now it is failing constantly.

Do you want me to try without calling .encode the method from above snippet or just replace + with %2B in .encode result?

[gapra-msft]

@kirankbs just replace the + with a %2B in the .encode result.

[rickle-msft]

@kirankbs Just following up on this a bit. I have checked out 12.1.0, and I don't think it should be possible to produce a sas token with a raw '+'. You can see in the encode method that we call tryAppendQueryParameter() on each parameter. That internally does a url encode which will transform the '+' into a '%2B'. When properly encoded, the sas will behave as desired.

In other words, if you are able to determine why your sas is being decoded or not being encoded, that will get us closer to understanding why you are seeing this error. One place to start is if you are appending the sas to the url yourself or using a url builder of some sort, there may be some decoding that we don't expect. To that end, you could try specifying the sas via the builder rather than whatever method you are using now to see if that helps.

Please let us know your results and how we can further assist you.

[kirankbs]

@rickle-msft Thank you very much for the explanation. I found where the problem is!

We were using version 12.0.0 and wrapping generated SAS token and Blob URL into data type from the HTTP framework. This was working fine but started failing all of sudden since few days.

I investigating a bit further after @rickle-msft explanation, calling the toString method on data type from HTTP framework encodes to UTF-8 which leads to 2 times encoding the SAS token.

The above cleanup solved the issue. We can close this issue.

[rickle-msft]

@kirankbs happy to hear it! Happy coding!