1

My question is this - When using Azure Storage, is this handled for me or do I have to make sure the user doesnt upload something that could compromise the server?

What should I be protecting myself against when dealing with files and Azure Storage?

Ivan
  • 23
  • 2
  • 8

3 Answers3

1

A possible solution, expecting that you want this functionality as a part of an application : You can make Web API app (or MVC app) in the Azure Cloud. This way you will have :

  • Control over the files and extensions which your users can upload. Described here.
  • Ability to scan for viruses the files that your users upload. Described here.
  • Control of the upload process. Also you can redirect from stream. Described here. Look at "saving file as stream". This way tour WEB API application will act as a security relay.
  • The benefit of the connection between the app and the blob - it will be very fast if they are in the same region. They will be most likely located very close to each other.
Ognyan Dimitrov
  • 6,026
  • 1
  • 48
  • 70
0

To my knowledge Azure Blob Storage does not have a built in way to prevent unwanted files from being uploaded if they are not prevented through user code. With Blob Storage a primary access key is required in order to upload files so the only way to get a file into storage will be through your exposed API [Website/App]. You will need to do file type validation there before allowing the user in. With this you can create SharedAccessSignatures that are valid for a set amount of time that will allow entrance into your storage account for file loading from an app or file loading through the web with CORS

Jon Gear
  • 1,008
  • 1
  • 11
  • 22
  • I understand that, but my concern is - can some files be uploaded that compromise the web site ? (cshtml/php files that get file listings for example) i.e. can someone upload executable files ? – Ivan Aug 07 '14 at 19:55
  • Yes. If you do not explicitly deny exes from being uploaded they can be. They wont do anything unless they are run though – Jon Gear Aug 08 '14 at 19:26
0

As also mentioned in jigear's answer, account key or a Shared Access Signature with write access is needed to upload a new blob. Whether this blob contains a php file or not is not known by Azure Storage, since Azure Storage Service does not look at blob contents. How these blobs are used by your website is controlled fully by your website.

Serdar Ozler
  • 3,752
  • 17
  • 24
  • If I am only passing on links on my site to download the uploaded files, are there any risks I should be protecting myself against? We will be employing some security checks on the files, but we won't have those in time for beta. – Ivan Aug 07 '14 at 20:31