Azure Blob 存储 SAS 令牌未正确形成 .NET答案

【问题标题】：Azure Blob Storage SAS Token not formed properly .NETAzure Blob 存储 SAS 令牌未正确形成 .NET
【发布时间】：2021-02-12 04:15:35
【问题描述】：

我正在尝试生成一个 SaS 令牌以从 Azure Blob 存储下载 Blob。生成令牌并尝试下载后，我遇到以下错误：

Azure.RequestFailedException
  HResult=0x80131500
  Message=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:6127b736-401e-002d-7413-aeddd5000000
Time:2020-10-29T16:53:15.3700463Z
Status: 403 (Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.)
ErrorCode: AuthenticationFailed

这是由 Azure 中的仪表板生成的令牌：

sp=r&st=2020-10-29T16:59:18Z&se=2020-10-29T17:59:18Z&spr=https&sv=2019-12-12&sr=b&sig=KEXuzAqhUOxwvJeGAeCxJ%2BroF2D7VDnx%2BgM7ABuch%2Fs%3D

这是我生成的令牌：

sv=2019-12-12&spr=https&st=2020-10-29T16:53:51Z&se=2020-10-29T22:53:51Z&sr=b&sp=r&sig=RsVzWh/QlRtMTDUXtVVKJ3WAkCjrpr2CRXN1idEyWdc=

这是我用来生成令牌的代码：

    private static Uri GetBlobSasUri(BlobContainerClient container,
                string blobName, StorageSharedKeyCredential key, string storedPolicyName = null)
    {
        // Create a SAS token that's valid for one hour.
        BlobSasBuilder sasBuilder = new BlobSasBuilder()
        {
            BlobContainerName = container.Name,
            BlobName = blobName,
            Resource = "b",
            Protocol = SasProtocol.Https,
        };

        if (storedPolicyName == null)
        {
            sasBuilder.StartsOn = DateTimeOffset.UtcNow;
            sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddHours(6);
            sasBuilder.SetPermissions(BlobContainerSasPermissions.Read);
        }
        else
        {
            sasBuilder.Identifier = storedPolicyName;
        }

        // Use the key to get the SAS token.
        BlobSasQueryParameters parameters = sasBuilder.ToSasQueryParameters(key);
        string sasToken = Uri.UnescapeDataString(parameters.ToString());

        Console.WriteLine("SAS for blob is: {0}", sasToken);
        Console.WriteLine();

        UriBuilder baseUri = new UriBuilder(container.GetBlockBlobClient(blobName).Uri);
        baseUri.Query = sasToken;

        return baseUri.Uri;
    }

【问题讨论】：

标签： c# .net azure azure-blob-storage

【解决方案1】：

我发现了问题。

签名需要进行 UrlEncoded
我需要将 StartsOn 偏移设置为 DateTimeOffset.UtcNow.AddMinutes(-5)

【讨论】：