Blob index tags of a blob cannot be retrieved using Azure Storage REST API

Question

Hello Support,

I have enabled on-upload malware scanning for my azure blob storage. Every time when I upload a file via Storage REST API, it scans the file and store the results under Blob Index Tags as below.

Now I need to retrieve this scan results that is under Blob index tags via REST API. as I'm trying with the PHP curl request, I get the below error.

"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature."

Below is my sample code.

$accountName = "xxxxx";
$containerName = "xxxx";
$blobName = "xxxxx";
$storageAccountKey = "xxxxx";

$url = "https://$accountName.blob.core.windows.net/$containerName/$blobName?index";

$date = gmdate('D, d M Y H:i:s \G\M\T');
$version = "2019-12-12";

 $stringtosign = "GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:". $date . "\nx-ms-version:".$version."\n/".$accountName."/".$containerName."/".$blobName; 

       $signature = 'xxxxxxx';  
     

$ch = curl_init(); 
curl_setopt ( $ch, CURLOPT_URL, $url); 
curl_setopt ( $ch, CURLOPT_SSL_VERIFYPEER, false );
curl_setopt ( $ch, CURLOPT_CUSTOMREQUEST, 'GET' ); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);     
$response = curl_exec($ch); 
print_r($response);

But the above code without "?index" in the URL works fine.

 $url = "https://$accountName.blob.core.windows.net/$containerName/$blobName";

So basically I need to retrieve contents under Blob index tags of the blob (the scan results) via REST API. Appreciate if someone can help on this!

Answer 1

Zahmi Zuhair I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer. Accepted answers show up at the top, resulting in improved discoverability for others.

Issue: Customer has enabled on-upload malware scanning for Azure blob storage. Every time a file is uploaded via Storage REST API, it scans the file and store the results under Blob Index Tags as below.

When the trying to retrieve this scan results that are under Blob index tags via REST API with the below PHP curl request, it fails.

$accountName = "xxxxx";
$containerName = "xxxx";
$blobName = "xxxxx";
$storageAccountKey = "xxxxx";

$url = "https://$accountName.blob.core.windows.net/$containerName/$blobName?index";

$date = gmdate('D, d M Y H:i:s \G\M\T');
$version = "2019-12-12";

 $stringtosign = "GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:". $date . "\nx-ms-version:".$version."\n/".$accountName."/".$containerName."/".$blobName; 

       $signature = 'xxxxxxx';  

$ch = curl_init(); 
curl_setopt ( $ch, CURLOPT_URL, $url); 
curl_setopt ( $ch, CURLOPT_SSL_VERIFYPEER, false );
curl_setopt ( $ch, CURLOPT_CUSTOMREQUEST, 'GET' ); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);     
$response = curl_exec($ch); 
print_r($response);

However, the above code without "?index" in the URL works fine.

Error Message: "Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature."

Cause: Missing the correct operation in the URL (?comp=tags) which indicates to Azure Storage that you are making a request to get the tags associated with the blob.

Solution: You need to add "?comp=tags" in the URL and create the signature from it.

Final $strintosign is as below.

$url = "https://$accountName.blob.core.windows.net/$containerName/$blobName?comp=tags";  

$stringtosign = "GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:". $date . "\nx-ms-version:".$version."\n/".$accountName."/".$containerName."/".$blobName."\ncomp:tags";

Answer 2

I found the solution finally!

you need to add "?comp=tags" in the URL and create the signature from it.

Final $strintosign is as below.

$url = "https://$accountName.blob.core.windows.net/$containerName/$blobName?comp=tags";
 
$stringtosign = "GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:". $date . "\nx-ms-version:".$version."\n/".$accountName."/".$containerName."/".$blobName."\ncomp:tags";

Hope this will help anyone who wants implement a similar thing :)