Using Azure CDN with Shared Signals

Question

I am trying to enable Azure to store most of my files for the application. I want to upload these files to a private container and a private blob in azure mode, and these downloads will be copied via the Azure CDN to all other nodes (still like private containers and blobs). Then I want my application to send a request for a saved blob and give me a link to the blob sharing signature for a certain period of time. However, I want the link to be generated for the nearest data center for the user. I will generate SAS every time I need blob, but I need to be able to use the SAS option compared to CDN. Is this possible with Azure or can I use only SAS with one data center?

Edit I would like our CDN to act as if it were a copy of our primary data center, so I don’t want the CDN objects to ever be deleted unless they are deleted from the primary data center. If I create a SAS and drop it at the end of the CDN URL, if the SAS expiration date has passed, but not the cache duration, can the user go back and access the file?

Here is my example:

• Duration of cache: 5 days
• Azure Storage URL: http://azstorage.blob.core.windows.net/images/img1.jpg
• CDN Endpoint: http://az507923.vo.msecnd.net/
• ASAS Storage SAS Parameter :? st = 2015-03-30T19% 3A21% 3A09Z & se = 2015-04-01T20% 3A21% 3A09Z & sr = c & sp = r & sig = STTE1p0ujzZr31ZjPaOlNoImCPcjss2GoRsOWDlpJuI% 3D
• The final URL of the CDN is: http://az507923.vo.msecnd.net/images/img1.jpg?st=2015-03-30T19%3A21%3A09Z&se=2015-04-01T20%3A21%3A09Z&sr=c&sp=r&sig= STTE1p0ujzZr31ZjPaOlNoImCPcjss2GoRsOWDlpJuI% 3D

Obviously, the user could access this URL before 4/1/2015, but what if they return on 4/2/2015, they will still have access?

Also, let's say I set the blob cache control header, which expires at the same time as the SAS URL, which is also after the cache duration. Then I return to the same block on 4/8/2015, we will generate a new SAS and pass it to the user, will blob still be on the CDN or will the cache control header remove it from the CDN

Answer 1

You can use SAS URLs with CDN. All you have to do is provide the correct SAS signature added to the CDN URL.

It will look like this:

• Azure Storage URL : http://azstorage.blob.core.windows.net/images/img1.jpg
• CDN Endpoint : http://az507923.vo.msecnd.net/
• SAS parameter for Azure storage :? st = 2015-09-17T19% 3A21% 3A09Z & se = 2015-09-17T20% 3A21% 3A09Z & sr = c & sp = r & sig = STTE1p0ujzZr31ZjPaOlNoImCPcjss2GoRsOWDlpJuI% 3D
• The final URL of the CDN : https://az507923.vo.msecnd.net/images/img1.jpg?st=2015-09-17T19%3A21%3A09Z&se=2015-09-17T20%3A21%3A09Z&sr=c&sp=r&sig=STTE1p0ujzZr31ZjPaOlNoJoJoJoJoJojoCP 3D

Some caveats with this approach:

• Anyone who has this url can access the file, so you should have a mechanism to save that url. It also means that if the URL leaks out, anyone can access the file, so you need to determine if this is an acceptable level of security.
• The CDN will cache the object using the full URL, including SAS, so the cached object will be valid for a cache duration of 7 days by default. This means that you need to make sure that you set the cache management headers on the blob in the same way as your SAS URL, so that the cached CDN expires at the same time as the SAS URL.