I am basically trying to integrate my blob storage with Azure front door and CDN profile. As the storage doesn't allow public access i would need to utilize the SAS token. I am looking if there is a way to hide the SAS token from end user. I believe URL rewrite should be able to add the SAS token I have tried many different way however none worked. Please advice. I have tried the approach mentioned here. https://learn.microsoft.com/en-us/answers/questions/1363114/url-rewrite-for-adding-sas-token-edgio-premium-rul

@Mudragada, Varun Krishna , Greetings. May I know what exactly was issue with using AFD Rule Engine? I did a lab and I was successfully able to achieve this, You have to append the SAS Token to the URL Path The trick is to rewrite the entire URLPath with {url_path} server variable + SAS Token Something like this, From AFD Logs, As you can see, the original request from client was <AFDEndPoint>/private/index.html But the request that went to the Storage Account was <StorageAccountName>.blob.core.windows.net:443/private/index.html?<SASToken> The "?<SASToken>" got appended because of the Rule Engine Rule. And I got a successful 200 For more information, URL Rewrite : https://learn.microsoft.com/en-us/azure/frontdoor/front-door-url-rewrite?pivots=front-door-standard-premium Server Variables in Rule Sets : https://learn.microsoft.com/en-us/azure/frontdoor/rule-set-server-variables#server-variable-format Kindly let us know if this helps or you need further assistance on this issue. Thanks, Kapil Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

In Azure Front door Premium, Is it possible to just add a query string using URL rewrite feature.

Accepted answer

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-05-21T10:35:49.5833333+00:00
@Mudragada, Varun Krishna ,

Greetings.

May I know what exactly was issue with using AFD Rule Engine?

I did a lab and I was successfully able to achieve this,

You have to append the SAS Token to the URL Path

The trick is to rewrite the entire URLPath with {url_path} server variable + SAS Token

Something like this,

From AFD Logs,

As you can see, the original request from client was <AFDEndPoint>/private/index.html

But the request that went to the Storage Account was <StorageAccountName>.blob.core.windows.net:443/private/index.html?<SASToken>

The "?<SASToken>" got appended because of the Rule Engine Rule.

And I got a successful 200

For more information,

URL Rewrite : https://learn.microsoft.com/en-us/azure/frontdoor/front-door-url-rewrite?pivots=front-door-standard-premium

Server Variables in Rule Sets : https://learn.microsoft.com/en-us/azure/frontdoor/rule-set-server-variables#server-variable-format

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

2 people found this answer helpful.
KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-05-21T10:40:19.5533333+00:00

@Mudragada, Varun Krishna ,

NOTE :

Rule Engine configuration might take upto 20-40 minutes for propagation across all our POP Servers.

You can just use the THEN section without IF section in RuleSets if you plan to apply the Rule to every request that reaches the AFD.

Mudragada, Varun Krishna 25 Reputation points

2024-05-23T15:25:35.9766667+00:00

Thanks @KapilAnanth-MSFT

I have tried the server variable and it worked as expected. Thank you so much for your support.

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-05-23T15:29:33.9133333+00:00

@Mudragada, Varun Krishna ,

Glad we could be of assistance.

Thanks for your contribution on Q&A and appreciate much for taking the time to share your feedback.

Bob Chandra 0 Reputation points

2024-07-15T08:02:15.7+00:00

Hi @KapilAnanth-MSFT ,

It works, but if somehow the request url contains query param, it would not working because somehow AFD would just append the query after the SAS token. for example example.com/storage/test.jpg?uniqueNumber=12345, then AFD would rewrite it to <some-blob-url>/storage/test.jpg?<SAS-token>?uniqueNumber=12345

I've tried to set the source pattern to /* but it would make the url not rewritten at all

Did you know how we should set the destination to not append the incoming query?

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-07-19T11:12:45.5866667+00:00

Bob Chandra ,

Looks like this is not configurable.

The purpose of URL Rewrite is to modify the Request Path only (path parameters)

And not Query String (query parameters)

So, basically, the rule appends the "Destination" after the path and not after the entire request

Hence, the SAS TOKEN is before the query parameters.

While you can achieve this using URL Redirect, this would expose the SAS Token in the browser and has limited use case.

This is useful if you trust the source to not abuse the SAS Token.

In such scenarios, I would suggest you consider using AFD Private Link and block internet access to the blob.

This way, only AFD can access the blob
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

In Azure Front door Premium, Is it possible to just add a query string using URL rewrite feature.

0 additional answers

Your answer