Azure的斑点SAS与IP范围限制

Question

我试图创建SAS的URI /令牌，让我的Azure存储的Blob下载。

我想这样做的一个blob级，为了不给无意中访问一个意想不到的资源。

当前的代码我用它来做到这一点：

public static string GetBlobSasUri(string containerName, string reference)
{
    // Create the CloudBlobContainer object
    CloudBlobContainer container = blobClient.GetContainerReference(containerName);
    container.CreateIfNotExists();

    // Get a reference to a blob within the container.
    CloudBlockBlob blob = container.GetBlockBlobReference(reference);

    // Set the expiry time and permissions for the blob.
    // In this case, the start time is specified as a few minutes in the past, to mitigate clock skew.
    // The shared access signature will be valid immediately.
    SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
    sasConstraints.SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5);
    sasConstraints.SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMonths(1);
    sasConstraints.Permissions = SharedAccessBlobPermissions.Read;

    // Generate the shared access signature on the blob, setting the constraints directly on the signature.
    string sasBlobToken = blob.GetSharedAccessSignature(sasConstraints);

    // Return the URI string for the container, including the SAS token.
    return blob.Uri + sasBlobToken;
}

这在很大程度上是基于在此文档中的例子：

Generate a shared access signature URI for a blob

这工作。但是，我看到其他SAS文件，它可以限制在一定的IP范围，以及：

Service SAS Uri Example

我的SAS令牌的理解是，签名的标牌参数，所以我不认为这是因为刚刚追加我的IP范围到SAS URI从我上面贴的代码返回，因为签名会那么不匹配一样容易。

然而，SharedAccessBlobPolicy只有三个领域，这是访问的开始/结束时间，以及权限。我没有看到有关的IP范围任何东西。

是否有可能在BLOB水平产生SAS的URI时，没有一个完整的帐户设置这些许可的范围？

Answer 1

请使用下面的代码：

        public static string GetBlobSasUri(string ipAddressFrom, string ipAddressTo)
        {
            CloudStorageAccount storageAccount = new CloudStorageAccount(new StorageCredentials("account_name", "account_key"), true);
            CloudBlobClient cloudBlobClient = storageAccount.CreateCloudBlobClient();
            var cloudBlobContainer = cloudBlobClient.GetContainerReference("test-1");

            cloudBlobContainer.CreateIfNotExists();

            CloudBlockBlob blob = cloudBlobContainer.GetBlockBlobReference("a.txt");

            var ipAddressRange = new IPAddressOrRange(ipAddressFrom, ipAddressTo);

            var sasBlobToken = blob.GetSharedAccessSignature(new SharedAccessBlobPolicy()
            {
                Permissions = SharedAccessBlobPermissions.List,
                SharedAccessExpiryTime = new DateTimeOffset(DateTime.UtcNow.AddHours(1))
            }, null, null,null, ipAddressRange);


            return blob.Uri + sasBlobToken;
        }