Question

在Azure Storage的最后一次更新之后，当我尝试上传或修改blob存储上的文件时，我得到了403。

我的代码非常简单，我认为它并不是与时间相关的代码。问题因为应用程序和存储都在欧洲西部数据服务器上。

我的代码很简单：

var connectionString =[MyCs, always working]
account = CloudStorageAccount.Parse(connectionString);
blobClient = account.CreateCloudBlobClient();
var container = blobClient.GetContainerReference(Name);
if (container.Exists()) return container.Name;
container.CreateIfNotExists();

我得到的错误就像：

The remote server returned an error: (403) Forbidden. at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext) at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.Create(BlobContainerPublicAccessType accessType, BlobRequestOptions requestOptions, OperationContext operationContext) at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.CreateIfNotExists(BlobContainerPublicAccessType accessType, BlobRequestOptions requestOptions, OperationContext operationContext) at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.CreateIfNotExists(BlobRequestOptions requestOptions, OperationContext operationContext) at HouseParty.AzureStorage.<CreateFile>d__6.MoveNext() in C:\Users\zibal\Source\Repos\HouseParty\HouseParty\AzureStorage.cs:line 51 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at HouseParty.Utils.<AddMedia>d__4.MoveNext() in C:\Users\zibal\Source\Repos\HouseParty\HouseParty\Utils.cs:line 77 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at HouseParty.Controllers.MediaController.<StaticAdd>d__3.MoveNext() in C:\Users\zibal\Source\Repos\HouseParty\HouseParty\Controllers\MediaController.cs:line 89 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at HouseParty.Controllers.UsersController.<Test>d__20.MoveNext() in C:\Users\zibal\Source\Repos\HouseParty\HouseParty\Controllers\UsersController.cs:line 271

P.S。：已经尝试从NUGET回滚到prev版本 P.P.S。：从LOCALHOST工作的代码

Answer 1

使用Microsoft服务3小时后，我们在Web应用程序的请求中注意到了一些奇怪的内容。

我们在这里开启了分析POST：

我们用于捕获网络跟踪的REST API是

https://management.azure.com/subscriptions/<subscription_ID>/resourceGroups/<Resource_Group_Name>/providers/Microsoft.Web/sites/<site_name>/networkTrace/start?duration=<duration_in_seconds>&api-version=2015-08-01

带标题的

 Authorization: the token we get from portal
 Content-Type: application/json

然后我们可以检查Kudu门户中\ LogFiles \ networktrace下的日志。这个例外在哪里：

  Processing exception Microsoft.Cis.Services.Nephos.Common.Authentication.AuthenticationFailureException : The MAC signature found in the HTTP request '*****************' is not the same as any computed signature. Server used following string to sign: 'PUT...7.***********==........x-ms-blob-type:BlockBlob.x-ms-client-request-id:********.x-ms-date:Mon, 15 May 2017 08:56:41 GMT.x-ms-request-id:*****.x-ms-version:2016-05-31./housepartystorage/img/test'.

我的请求（由Azure SDK创建）就像

Hypertext Transfer Protocol
PUT /img/test HTTP/1.1\r\n
    [Expert Info (Chat/Sequence): PUT /img/test HTTP/1.1\r\n]
        [PUT /img/test HTTP/1.1\r\n]
        [Severity level: Chat]
        [Group: Sequence]
    Request Method: PUT
    Request URI: /img/test
    Request Version: HTTP/1.1
User-Agent: Azure-Storage/8.1.1 (.NET CLR 4.0.30319.42000; Win32NT 6.2.9200.0)\r\n
x-ms-version: 2016-05-31\r\n
Content-MD5: LAT5h1nXhLLXm9cujfJFfA==\r\n
x-ms-blob-type: BlockBlob\r\n
x-ms-client-request-id: 95933c6d-144e-4295-9bcd-405aba4bedf6\r\n
x-ms-date: Mon, 15 May 2017 08:56:39 GMT\r\n
Authorization: SharedKey MYBLOB:+[SECRET]=\r\n
x-ms-request-id: 5+l1WofovW0=\r\n
Host: [MYBLOB].blob.core.windows.net\r\n
Content-Length: 7\r\n
    [Content length: 7]
\r\n
[Full request URI: http://MYBLOB.blob.core.windows.net/img/test]
[HTTP request 3/5]
[Response in frame: 30]
[Next request in frame: 31]
File Data: 7 bytes
Data (7 bytes)
    Data: 20202020202020
    [Length: 7]

事实证明我的应用程序正在添加一个额外的标题，如：

 x-ms-request-id

此额外标题来自MICROSOFT APPLICATION INSIGHT。

在Application Insight中禁用（从NUGET卸载）后，一切正常！

Answer 2

我们在应用程序服务的wwwroot / applicationinsights.config中对此行进行了注释

->

这删除了其他标题。

请尝试一下。

Azure存储403未经Azure应用服务授权

2 个答案: