测试天蓝色 Blob 存储上传时出现 403 错误

Question

我阅读并实现了以下文章，用于在 javascript 客户端和 azure blob 存储之间分块文件：http://gauravmantri.com/2013/02/16/uploading-large-files-in-windows-azure-blob-storage-using-shared-access-signature-html-and-javascript。我似乎能够生成共享访问签名并创建权限，但是当我尝试使用以下 SAS URL 将块“放入”天蓝色时，我收到错误：“403（服务器无法验证请求. 确保 Authorization 标头的值格式正确，包括签名。）”。有人可以请我做错了什么。这是代码和url和代码：

//sas url that is generated
http://testing.blob.core.windows.net/image-container?sr=c&si=Perms1&sig=UowbDVCLfFdiVktTZuoupj6BiMUzLRxF3WEZlXKMJcA%3D&comp=block&blockid=YmxvY2stMDAwMDAw


//Upload the blocks to azure storage
if (evt.target.readyState == FileReader.DONE) { // DONE == 2
    var uri = submitUri + '&comp=block&blockid=' + blockIds[blockIds.length - 1];
    var requestData = new Uint8Array(evt.target.result);
    $.ajax({
        url: uri,
        type: "PUT",
        data: requestData,
        processData: false,
        beforeSend: function(xhr) {
            xhr.setRequestHeader('x-ms-blob-type', 'BlockBlob');
            //xhr.setRequestHeader('Content-Length', requestData.length);
        },
        success: function (data, status) {
            console.log(data);
            console.log(status);
            bytesUploaded += requestData.length;
            var percentComplete = ((parseFloat(bytesUploaded) / parseFloat(selectedFile.size)) * 100).toFixed(2);
            $("#fileUploadProgress").text(percentComplete + " %");
            uploadFileInBlocks();
        },
        error: function(xhr, desc, err) {
            console.log(desc);
            console.log(err);
        }
    });
}


         //Create stored access permissions
         Microsoft.WindowsAzure.Storage.Blob.CloudBlobClient blobClient = _storageAccount.CreateCloudBlobClient();

        //Get a reference to a container to use for the sample code, and create it if it does not exist.
        Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer container = blobClient.GetContainerReference("images-container");
        container.CreateIfNotExists();

        //Create a new stored access policy and define its constraints.
        Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPolicy sharedPolicy = new Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPolicy()
        {
            SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(10),
            Permissions = Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPermissions.Write
        };

        //Get the container's existing permissions.
        Microsoft.WindowsAzure.Storage.Blob.BlobContainerPermissions permissions = container.GetPermissions();

        //Add the new policy to the container's permissions.
         if (!permissions.SharedAccessPolicies.ContainsKey(CloudConfiguration.GetConfigurationSetting("PolicyName")))
        {
            permissions.SharedAccessPolicies.Clear();
            permissions.SharedAccessPolicies.Add(policyName, sharedPolicy);
            container.SetPermissions(permissions);
        }


        //Generate the SAS Locator
       CreateStoredAccessPolicy(CloudConfiguration.GetConfigurationSetting("PolicyName"));

        //Create the blob client object.
        Microsoft.WindowsAzure.StorageClient.CloudBlobClient blobClient = _storageAccount.CreateCloudBlobClient();

        //Get a reference to a container to use for the sample code, and create it if it does not exist.
        Microsoft.WindowsAzure.StorageClient.CloudBlobContainer container = blobClient.GetContainerReference("images-container");

        //Set the expiry time and permissions for the container.
        //In this case no start time is specified, so the shared access signature becomes valid immediately.
        SharedAccessPolicy sasConstraints = new SharedAccessPolicy();

        //Generate the shared access signature on the container, setting the constraints directly on the signature.
        string sasContainerToken = container.GetSharedAccessSignature(sasConstraints, CloudConfiguration.GetConfigurationSetting("PolicyName"));

        var newFileFile = Guid.NewGuid().ToString() + extension;
        var blobUri = new UriBuilder(container.AbsoluteUri.ToString() + sasContainerToken);

        // return the new VideoAsset 
        return new ImageAsset() { SasLocator = blobUri.AbsoluteUri.ToString(), NewFileName = newFileFile };

我目前正在本地机器上的 azure 模拟器中以调试模式进行测试。不确定这是否是一个因素。

Answer 1

当您在容器上建立存储访问策略时，最长可能需要 30 秒才能生效。在此时间间隔内，与存储的访问策略关联的共享访问签名将失败并显示状态代码 403（禁止），直到访问策略变为活动状态。有关共享访问政策的更多信息，请查看 - https://msdn.microsoft.com/library/azure/dd179391.aspx。

因此，在确保生成上述正确 URL 的同时，请确保等待 30 秒后再使用该策略。

Answer 2

即使您尝试上传块，生成的 URL 也会指向容器。它还应该包含像 http://testing.blob.core.windows.net/image-container/image-blob 这样的 blob 名称。