Azure Blob storage CORS Policy does not applying

Hemant Ashok 15

Hello,

I have set up Azure Blob Storage with a Private access level, and I am able to access the blob files by generating access tokens from my application.

I have also configured CORS, but it's not working as expected.

My goal is to ensure that only my application can access the blob content using the access token and CORS policy.

Could you please assist me with this issue?

Patchfox 4,011 Reputation points

2025-02-21T10:58:09.6133333+00:00

Hi Hemant Ashok I want to help you with this question, but could you send us your current CORS config, so we know more about your configuration. Thanks!
Vinod Kumar Reddy Chilupuri 2,470 Reputation points Microsoft Vendor

2025-02-21T11:15:05.4466667+00:00
Hi Hemant Ashok,

It seems you're having trouble with the CORS policy on your Azure Blob Storage.

Here are a few things you can check.

CORS Configuration: Properly configure the CORS settings to allow requests only from your application's domain. Ensure that the CORS settings are correctly configured for your Blob Storage account. You can do this by navigating to your storage account in the Azure portal, selecting the "CORS" option under the Blob service section, and configuring the allowed origins, methods, headers, and exposed headers1.

Allowed Origins: Make sure that the allowed origins include the domain from which your application is making requests. If you're using a wildcard (*), it should allow requests from any domain, but it's generally better to specify the exact domains for security reasons.

Access Tokens: Verify that the access tokens being generated by your application have the necessary permissions to access the Blob Storage. You can check this by inspecting the token and ensuring it includes the required scopes.

Browser Cache: Sometimes, browser cache can cause issues with CORS. Try clearing your browser cache or testing the application in an incognito/private browsing window.

Network Configuration: Ensure that there is no network security groups (NSGs) or firewall rules blocking the requests from your application to the Azure Blob Storage.

If you may want to implement additional security measures to further restrict access:

Use SAS Tokens: Generate Shared Access Signature (SAS) tokens with limited permissions and expiration times to control access to the blob content. https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Network Security: Configure network security rules, such as virtual network (VNet) integration and firewalls, to restrict access to the storage account from specific IP addresses or networks. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

By combining these configurations, you can achieve your goal of ensuring that only your application can access the blob content using the access token and CORS policy.

https://learn.microsoft.com/en-us/azure/api-management/cors-policy

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Hemant Ashok 15 Reputation points

2025-02-21T11:42:20.7533333+00:00

Hi
below is the container settings

and the CORS settings
Vinod Kumar Reddy Chilupuri 2,470 Reputation points Microsoft Vendor

2025-02-21T13:00:55.3466667+00:00
Hi Hemant Ashok,

In the storage account settings, click on CORS under the Blob service section.

Configure the following settings:

Allowed origins: Use the wildcard character (*) to permit all domains.

Allowed methods: Select GET, POST, OPTIONS, and PUT.

Allowed headers: Include x-ms-blob-type and content-type.

Exposed headers: Add x-ms-blob-type.

Max age: Set to 0 seconds.

Click Save to apply the changes.

See: https://learn.microsoft.com/en-us/cli/azure/storage/cors?view=azure-cli-latest

Hope the above answer helps! Please let us know do you have any further queries.
Hemant Ashok 15 Reputation points

2025-02-21T13:06:32.7566667+00:00

Hi Vinod,
I have tried with same settings just instead of putting * on domain I just add our domain but still it is not restricted to my domain

1 answer

Alex Burlachenko 1,190 Reputation points

2025-02-21T11:02:08.7133333+00:00

Hey Hemant,

CORS can be a pain, but let’s keep it simple. If your app is server-side (using tokens), CORS doesn’t apply it’s only for browser requests. If it’s frontend, check your CORS rules in Azure step by step

first is set allowed origins (your app’s domain)? next allow methods (GET, POST, etc.). and wait a few mins Azure caches CORS settings.

If it’s still not working, check the browser console for errors.

You’ve got this! Let me know if you need more help.

rgds,

Alex,
Please sign in to rate this answer.
Hemant Ashok 15 Reputation points

2025-02-21T11:17:10.8233333+00:00

Hi Alex,
I have set the CORS rule but it is not working.

if I try to access the blob content file url using access token it is visible. I want to restrict it. User can only see the file content if the request is come from the my application
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Blob storage CORS Policy does not applying

1 answer

Your answer