We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time.

We're considering achieving this by generating a short-lived SAS token and sending that to the user (this user may be anyone on the internet, hence "untrusted").

Are SAS tokens safe enough? They are HMAC-SHA256 tokens, so I'm not sure if a person could try figure out our genuine secret account key by brute-force (i.e. generating tokens with random keys until a key matches the hmac-sha256 signature).

  • After some more research, I think the answer is "yes", it's secure, as long as we have a key rotation process in place. That should mitigate any brute force attacks. – willem Sep 17 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.