Restrict public access to Static Website

Question

We have a SPA deployed as Static Website in Azure Blob Storage, behind an Azure Front Door. How can we block direct access to the Static Website URL but allow access only through Front Door's URL?

Answer 1

We managed to do it actually with the following way

1. Created a virtual network
2. Configured storage's firewall to allow access only from the virtual network
3. Created an application gateway (instead of a front door) on the same virtual network that routes all traffic from a public ip to the url of the static website hosted in the blob storage.

With this setup we are able to access the Static Website through the public ip of the gateway but we are not able to access the website directly from its own url.

Answer 2

@Andreas H
Disabling public access on a storage account does not affect static websites that are hosted in that storage account. Additionally, you can modify the public access level of the $web container, but this has no impact on the primary static website endpoint because these files are served through anonymous access requests. That means public (read-only) access to all files. So this is not an option currently when using static website hosting in Azure Storage. If you would like, you can submit a feature request on our feedback forum which will be reviewed by our product teams.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.