The request URI is invalid. This is for a single AFD profile with 2 endpoints

Question

The request URI is invalid. This is for a single AFD profile with 2 endpoints

Matthew Barrett 136

I have a single AFD standard profile to support two endpoints and two routes. One endpoint and route is for www. The other is for a blob storage account. However, I get an invalid URI error when I try to access the custom domain of the storage account.
I have other AFDs setups with a single endpoint and multiple routes for a multi-tenant environment that works fine.

Is the problem the two endpoints with different routes?

rvinnakota 4,760 Reputation points Moderator

2025-02-24T19:58:20.26+00:00
Hi @Matthew Barrett

I understood that you are getting the invalid URI error when accessing your blob storage custom domain via Azure Front Door (AFD). This is most likely due to misconfiguration in the AFD route/origin settings for the storage account and this error typically occurs when:

The Host header forwarded by AFD does not match the storage account’s expected hostname.

The origin settings in AFD are not properly configured for the storage account.

The TLS/SSL certificate for the custom domain is missing or misconfigured.

Please ensure that AFD origin settings for the storage account are configured as below.

Origin Type: Storage (select your Azure Storage account).

Origin Hostname: Use the blob storage endpoint (e.g., storagetest.blob.core.windows.net). Match your storage account’s TLS settings either HTTP Port: 80 / HTTPS Port: 443. Do not use the custom domain (e.g., storage.contoso.com) as the origin hostname. The origin must point to the Azure Storage endpoint. (e.g., storagetest.blob.core.windows.net).

If above steps doesn't help. Please share the below details to figure out the issue.

How will users access the blob storage via AFD (like will they use Custom domain mapped to AFD or AFD endpoint?)

What is the Origin Type, Origin Hostname and Host header was configured on AFD?

Also, I would request you to check the AFD’s Diagnostics Logs for detailed error logs and also, validate the storage account’s Network Settings to ensure AFD’s backend IPs are allowed.
Matthew Barrett 136 Reputation points

2025-02-24T21:09:13.3+00:00

I have a custom domain pointing to the AFD endpoint.
I tried modifying my origin group so that both the "Host name" and "Origin host header" point to the storage.blob.core.windows.net account and the Origin type is Storage (Azure Blobs).
However, I am getting an authorization error now. I can access a file from a container using the storage account name and it works fine if I use a CDN instead of AFD. CDNs are being deprecated and I would like to start adding my storage accounts to AFD.
rvinnakota 4,760 Reputation points Moderator

2025-02-24T21:34:24.75+00:00

Hi @Matthew Barrett,

Thank you for reply,

Could you please share the error screenshot?
Matthew Barrett 136 Reputation points

2025-02-24T21:36:05.8833333+00:00

I have a custom domain pointing to the AFD endpoint. I tried modifying my origin group so that both the "Host name" and "Origin host header" point to the storage.blob.core.windows.net account and the Origin type is Storage (Azure Blobs). However, I am getting an authorization error now. I can access a file from a container using the storage account name and it works fine if I use a CDN instead of AFD. CDNs are being deprecated and I would like to start adding my storage accounts to AFD.
Matthew Barrett 136 Reputation points

2025-02-24T21:37:46.4366667+00:00
rvinnakota 4,760 Reputation points Moderator

2025-02-24T22:08:59.8033333+00:00

Hi @Matthew Barrett
Thank you for reply,

Can you please the check the Networking settings in the storage account

Or
you can you the SAS token to access the file.

Example:

https://*.azurefd.net/?<SAS_Token>

Kindly let us know if the above helps or you need further assistance on this issue.
Matthew Barrett 136 Reputation points

2025-02-25T01:42:17.6533333+00:00

THe network is open and I do not use tokens.
Matthew Barrett 136 Reputation points

2025-02-25T03:17:03.8866667+00:00

I found the answer to fix this with.

Unlike CDN, AFD requires the custom domain to also be added to the storage account.

Go to your Storage account, under Security + Networking select Networking. Then in the center menu select Custom domain, enter your domain name, and select "Use indirect CNAME validation". You'll need a CNAME record for this to work.
asverify.customdomainname -> asverify.storagename.blob.core.windows.net

Accepted answer

0 additional answers

Your answer

rvinnakota 4,760 Reputation points Moderator

2025-02-24T19:58:20.26+00:00

Hi @Matthew Barrett

I understood that you are getting the invalid URI error when accessing your blob storage custom domain via Azure Front Door (AFD). This is most likely due to misconfiguration in the AFD route/origin settings for the storage account and this error typically occurs when:

The Host header forwarded by AFD does not match the storage account’s expected hostname.

The origin settings in AFD are not properly configured for the storage account.

The TLS/SSL certificate for the custom domain is missing or misconfigured.

Please ensure that AFD origin settings for the storage account are configured as below.

Origin Type: Storage (select your Azure Storage account).

Origin Hostname: Use the blob storage endpoint (e.g., storagetest.blob.core.windows.net). Match your storage account’s TLS settings either HTTP Port: 80 / HTTPS Port: 443. Do not use the custom domain (e.g., storage.contoso.com) as the origin hostname. The origin must point to the Azure Storage endpoint. (e.g., storagetest.blob.core.windows.net).

If above steps doesn't help. Please share the below details to figure out the issue.

How will users access the blob storage via AFD (like will they use Custom domain mapped to AFD or AFD endpoint?)

What is the Origin Type, Origin Hostname and Host header was configured on AFD?

Also, I would request you to check the AFD’s Diagnostics Logs for detailed error logs and also, validate the storage account’s Network Settings to ensure AFD’s backend IPs are allowed.
Matthew Barrett 136 Reputation points

2025-02-24T21:09:13.3+00:00

I have a custom domain pointing to the AFD endpoint.
I tried modifying my origin group so that both the "Host name" and "Origin host header" point to the storage.blob.core.windows.net account and the Origin type is Storage (Azure Blobs).
However, I am getting an authorization error now. I can access a file from a container using the storage account name and it works fine if I use a CDN instead of AFD. CDNs are being deprecated and I would like to start adding my storage accounts to AFD.
rvinnakota 4,760 Reputation points Moderator

2025-02-24T21:34:24.75+00:00

Hi @Matthew Barrett,

Thank you for reply,

Could you please share the error screenshot?
Matthew Barrett 136 Reputation points

2025-02-24T21:36:05.8833333+00:00

I have a custom domain pointing to the AFD endpoint. I tried modifying my origin group so that both the "Host name" and "Origin host header" point to the storage.blob.core.windows.net account and the Origin type is Storage (Azure Blobs). However, I am getting an authorization error now. I can access a file from a container using the storage account name and it works fine if I use a CDN instead of AFD. CDNs are being deprecated and I would like to start adding my storage accounts to AFD.
Matthew Barrett 136 Reputation points

2025-02-24T21:37:46.4366667+00:00
rvinnakota 4,760 Reputation points Moderator

2025-02-24T22:08:59.8033333+00:00

Hi @Matthew Barrett
Thank you for reply,

Can you please the check the Networking settings in the storage account

Or
you can you the SAS token to access the file.

Example:

https://*.azurefd.net/?<SAS_Token>

Kindly let us know if the above helps or you need further assistance on this issue.
Matthew Barrett 136 Reputation points

2025-02-25T01:42:17.6533333+00:00

THe network is open and I do not use tokens.
Matthew Barrett 136 Reputation points

2025-02-25T03:17:03.8866667+00:00

I found the answer to fix this with.

Unlike CDN, AFD requires the custom domain to also be added to the storage account.

Go to your Storage account, under Security + Networking select Networking. Then in the center menu select Custom domain, enter your domain name, and select "Use indirect CNAME validation". You'll need a CNAME record for this to work.
asverify.customdomainname -> asverify.storagename.blob.core.windows.net

Answer 1

Hi @Matthew Barrett

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: I have other AFDs setups with a single endpoint and multiple routes for a multi-tenant environment that works fine. Is the problem the two endpoints with different routes?

Solution: Unlike CDN, AFD requires the custom domain to also be added to the storage account.

Go to your Storage account, under Security + Networking select Networking. Then in the center menu select Custom domain, enter your domain name, and select "Use indirect CNAME validation". You'll need a CNAME record for this to work. asverify.customdomainname -> asverify.storagename.blob.core.windows.net

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Share via

The request URI is invalid. This is for a single AFD profile with 2 endpoints

0 additional answers

Your answer