使用 .NET 實作 Azure Storage SAS 上傳檔案起手勢

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

        BlobContainerClient container = new("connectioningString", "containerName");
        if (!container.CanGenerateSasUri)
            throw new Exception("The container can't generate SAS URI");

        var sasBuilder = new BlobSasBuilder
        {
            BlobContainerName = container.Name,
            Resource = "c",
            ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(20)
        };

        sasBuilder.SetPermissions(BlobContainerSasPermissions.All);
        var sasUri = container.GenerateSasUri(sasBuilder);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

async static Task<Uri> GetUserDelegationSasBlob(BlobClient blobClient)
{
    BlobServiceClient blobServiceClient = blobClient.GetParentBlobContainerClient().GetParentBlobServiceClient();

    // Get a user delegation key for the Blob service that's valid for 7 days.
    // You can use the key to generate any number of shared access signatures over the lifetime of the key.
    UserDelegationKey userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(7));

    // Create a SAS token that's valid for 7 days.
    BlobSasBuilder sasBuilder = new BlobSasBuilder()
    {
        BlobContainerName = blobClient.BlobContainerName,
        BlobName = blobClient.Name,
        Resource = "b",
        StartsOn = DateTimeOffset.UtcNow,
        ExpiresOn = DateTimeOffset.UtcNow.AddDays(7)
    };

    // Specify read permissions for the SAS.
    sasBuilder.SetPermissions(BlobSasPermissions.Read);

    // Use the key to get the SAS token.
    string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();

    // Construct the full URI, including the SAS token.
    UriBuilder fullUri = new UriBuilder()
    {
        Scheme = "https",
        Host = string.Format("{0}.blob.core.windows.net", blobServiceClient.AccountName),
        Path = string.Format("{0}/{1}", blobClient.BlobContainerName, blobClient.Name),
        Query = sasToken
    };

    // Create a BlobClient object that can be used to upload a file with the SAS token
    BlobClient sasBlobClient = new BlobClient(fullUri.Uri);

    // Upload a file
    using (FileStream stream = File.OpenRead(localFilePath))
    {
        await sasBlobClient.UploadAsync(stream);
    }

    return fullUri.Uri;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

[ApiController]
[Route("[controller]")]
public class AttachmentController : ControllerBase
{
    private readonly IConfiguration _configuration;

    public AttachmentController(IConfiguration configuration)
    {
        _configuration = configuration;
    }

    [HttpGet("token")]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(typeof(AzureStorageSASResult), StatusCodes.Status200OK)]
    public IActionResult SASToken()
    {
        var azureStorageConfig = _configuration.GetSection("AppSettings:AzureStorage").Get<AzureStorageConfig>();

        BlobContainerClient container = new(azureStorageConfig.ConnectionString, azureStorageConfig.ContainerName);
        if (!container.CanGenerateSasUri)
            return Conflict("The container can't generate SAS URI");

        var sasBuilder = new BlobSasBuilder
        {
            BlobContainerName = container.Name,
            Resource = "c",
            ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(azureStorageConfig.TokenExpirationMinutes)
        };

        sasBuilder.SetPermissions(BlobContainerSasPermissions.All);
        var sasUri = container.GenerateSasUri(sasBuilder);


        return Ok(result);
    }
}

1
2
3
4
5
6
7

"AppSettings": {
  "AzureStorage": {
    "ConnectionString": "<connection string>",
    "ContainerName": "attachments",
    "TokenExpirationMinutes": 20
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

        BlobContainerClient container = new("connectionstring", "containerName");
        BlobServiceClient blobServiceClient = new BlobServiceClient("connectionstring");
        BlobContainerClient blobContainerClient = blobServiceClient.GetBlobContainerClient("containerName");
        BlobClient blobClient = blobContainerClient.GetBlobClient("test.png");

        Uri sasUri = GetServiceSasUriForBlob(blobClient);
		 
		 GetServiceSasUriForBlob(blobClient).Dump();


static Uri GetServiceSasUriForBlob(BlobClient blobClient,
    string storedPolicyName = null)
{
    // Check whether this BlobClient object has been authorized with Shared Key.
    if (blobClient.CanGenerateSasUri)
    {
        // Create a SAS token that's valid for one hour.
        BlobSasBuilder sasBuilder = new BlobSasBuilder()
        {
            BlobContainerName = blobClient.GetParentBlobContainerClient().Name,
			BlobName = blobClient.Name,
			Resource = "b"
		};

		if (storedPolicyName == null)
		{
			sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddHours(1);
			sasBuilder.SetPermissions(BlobSasPermissions.Read |
				BlobSasPermissions.Write);
		}
		else
		{
			sasBuilder.Identifier = storedPolicyName;
        }

        Uri sasUri = blobClient.GenerateSasUri(sasBuilder);
        Console.WriteLine("SAS URI for blob is: {0}", sasUri);
        Console.WriteLine();

		return sasUri;
	}
	else
	{
		Console.WriteLine(@"BlobClient must be authorized with Shared Key 
                          credentials to create a service SAS.");
		return null;
	}
}

1
2
3
4

curl --location --request PUT 'https://xxxxx.blob.core.windows.net/.......' \
--header 'x-ms-blob-type: BlockBlob' \
--header 'Content-Type: image/png' \
--data '@/C:/Users/steve/OneDrive/圖片/螢幕擷取畫面/螢幕擷取畫面_20230222_100659.png'