Azure Blob storage CORS Policy does not applying

Question

Azure Blob storage CORS Policy does not applying

Hemant Ashok 15

Hello,

I have set up Azure Blob Storage with a Private access level, and I am able to access the blob files by generating access tokens from my application.

I have also configured CORS, but it's not working as expected.

My goal is to ensure that only my application can access the blob content using the access token and CORS policy.

Could you please assist me with this issue?

Patchfox 4,176 Reputation points

2025-02-21T10:58:09.6133333+00:00

Hi Hemant Ashok I want to help you with this question, but could you send us your current CORS config, so we know more about your configuration. Thanks!
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-21T11:15:05.4466667+00:00
Hi Hemant Ashok,

It seems you're having trouble with the CORS policy on your Azure Blob Storage.

Here are a few things you can check.

CORS Configuration: Properly configure the CORS settings to allow requests only from your application's domain. Ensure that the CORS settings are correctly configured for your Blob Storage account. You can do this by navigating to your storage account in the Azure portal, selecting the "CORS" option under the Blob service section, and configuring the allowed origins, methods, headers, and exposed headers1.

Allowed Origins: Make sure that the allowed origins include the domain from which your application is making requests. If you're using a wildcard (*), it should allow requests from any domain, but it's generally better to specify the exact domains for security reasons.

Access Tokens: Verify that the access tokens being generated by your application have the necessary permissions to access the Blob Storage. You can check this by inspecting the token and ensuring it includes the required scopes.

Browser Cache: Sometimes, browser cache can cause issues with CORS. Try clearing your browser cache or testing the application in an incognito/private browsing window.

Network Configuration: Ensure that there is no network security groups (NSGs) or firewall rules blocking the requests from your application to the Azure Blob Storage.

If you may want to implement additional security measures to further restrict access:

Use SAS Tokens: Generate Shared Access Signature (SAS) tokens with limited permissions and expiration times to control access to the blob content. https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Network Security: Configure network security rules, such as virtual network (VNet) integration and firewalls, to restrict access to the storage account from specific IP addresses or networks. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

By combining these configurations, you can achieve your goal of ensuring that only your application can access the blob content using the access token and CORS policy.

https://learn.microsoft.com/en-us/azure/api-management/cors-policy

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Hemant Ashok 15 Reputation points

2025-02-21T11:42:20.7533333+00:00

Hi
below is the container settings

and the CORS settings
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-21T13:00:55.3466667+00:00
Hi Hemant Ashok,

In the storage account settings, click on CORS under the Blob service section.

Configure the following settings:

Allowed origins: Use the wildcard character (*) to permit all domains.

Allowed methods: Select GET, POST, OPTIONS, and PUT.

Allowed headers: Include x-ms-blob-type and content-type.

Exposed headers: Add x-ms-blob-type.

Max age: Set to 0 seconds.

Click Save to apply the changes.

See: https://learn.microsoft.com/en-us/cli/azure/storage/cors?view=azure-cli-latest

Hope the above answer helps! Please let us know do you have any further queries.
Hemant Ashok 15 Reputation points

2025-02-21T13:06:32.7566667+00:00

Hi Vinod,
I have tried with same settings just instead of putting * on domain I just add our domain but still it is not restricted to my domain
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-24T14:54:02.99+00:00

Hi Hemant Ashok,
We are checking internally with our team on this issue. We will update you as soon as possible once we get an update from our team.
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-25T09:44:28.5866667+00:00

Hi Hemant Ashok,

Can you please give us the information of how you are authenticating and fetching the blobs.
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-26T12:51:48.2433333+00:00

Hi Hemant Ashok,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond back with the more details and we will try to help.
Livermore, Graham 0 Reputation points

2025-06-21T00:17:09.5666667+00:00

Hello I am having the same issue where ive set all cors policy options with the wildcard value and methods GET and LIST. As well as creating a sas token at the container level, and using it in my app to fetch the data from my blob container. Is there something im missing that wasnt stated above? I am trying to access our companies blob storage via cortex io plugin UI. I cant access via cortex dev server running on localhost:9000 or in production. Ive been searching if there are restrictions from cortex side but havent found anything yet. The only error thats thrown is a cors policy error, data can not be fetched error. I am using the sas url copied directly from azure portal. Thanks for any help! edit: i resolved this and posted my answer. Thanks!

2 answers

Your answer

Patchfox 4,176 Reputation points

2025-02-21T10:58:09.6133333+00:00

Hi Hemant Ashok I want to help you with this question, but could you send us your current CORS config, so we know more about your configuration. Thanks!
Hemant Ashok 15 Reputation points

2025-02-21T11:42:20.7533333+00:00

Hi
below is the container settings

and the CORS settings
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-21T13:00:55.3466667+00:00

Hi Hemant Ashok,

In the storage account settings, click on CORS under the Blob service section.

Configure the following settings:

Allowed origins: Use the wildcard character (*) to permit all domains.

Allowed methods: Select GET, POST, OPTIONS, and PUT.

Allowed headers: Include x-ms-blob-type and content-type.

Exposed headers: Add x-ms-blob-type.

Max age: Set to 0 seconds.

Click Save to apply the changes.

See: https://learn.microsoft.com/en-us/cli/azure/storage/cors?view=azure-cli-latest

Hope the above answer helps! Please let us know do you have any further queries.
Hemant Ashok 15 Reputation points

2025-02-21T13:06:32.7566667+00:00

Hi Vinod,
I have tried with same settings just instead of putting * on domain I just add our domain but still it is not restricted to my domain
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-24T14:54:02.99+00:00

Hi Hemant Ashok,
We are checking internally with our team on this issue. We will update you as soon as possible once we get an update from our team.
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-25T09:44:28.5866667+00:00

Hi Hemant Ashok,

Can you please give us the information of how you are authenticating and fetching the blobs.
Vinod Kumar Reddy Chilupuri 4,185 Reputation points Microsoft External Staff Moderator

2025-02-26T12:51:48.2433333+00:00

Hi Hemant Ashok,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond back with the more details and we will try to help.
Livermore, Graham 0 Reputation points

2025-06-21T00:17:09.5666667+00:00

Hello I am having the same issue where ive set all cors policy options with the wildcard value and methods GET and LIST. As well as creating a sas token at the container level, and using it in my app to fetch the data from my blob container. Is there something im missing that wasnt stated above? I am trying to access our companies blob storage via cortex io plugin UI. I cant access via cortex dev server running on localhost:9000 or in production. Ive been searching if there are restrictions from cortex side but havent found anything yet. The only error thats thrown is a cors policy error, data can not be fetched error. I am using the sas url copied directly from azure portal. Thanks for any help! edit: i resolved this and posted my answer. Thanks!

Answer 1

Alex Burlachenko 10,255

Hey Hemant,

CORS can be a pain, but let’s keep it simple. If your app is server-side (using tokens), CORS doesn’t apply it’s only for browser requests. If it’s frontend, check your CORS rules in Azure step by step

first is set allowed origins (your app’s domain)? next allow methods (GET, POST, etc.). and wait a few mins Azure caches CORS settings.

If it’s still not working, check the browser console for errors.

You’ve got this! Let me know if you need more help.

rgds,

Alex,

Hemant Ashok 15 Reputation points

2025-02-21T11:17:10.8233333+00:00

Hi Alex,
I have set the CORS rule but it is not working.

if I try to access the blob content file url using access token it is visible. I want to restrict it. User can only see the file content if the request is come from the my application
Patchfox 4,176 Reputation points

2025-02-22T21:00:12.1566667+00:00

What is the response you get when you request the file with the domain you want to restrict

Answer 2

I resolved this using sas tokens and cors rules with correct access when creating the token ie rl and r (read, read-list). Under CORS rules, i added my origin. The exact one which was throwing the error. I set GET, HEAD and OPTIONS. Then under Allowed headers: x-ms-blob-type and content-type. Exposed headers: x-ms-blob-type. max-age: 0. I also found that if your container has extra paths, they are not really paths. as in: baseUrl/container/something/something/blob.json so you need to fetch the data using prefixes and not slashes. as in baseUrl/container&prefix=something/something/sas-token. I also noticed it took about 15 minutes to apply. So being patient here after each change pays off.

Share via

Azure Blob storage CORS Policy does not applying

2 answers

Your answer