1

I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible.

When I generate a connection string there is a SAS token embedded in the URL. That token has different permissions parameters and they are signed with the service private key.

But I don't understand how putting this SAS token in the URL is safe. If I launch such a URL with the token in it, what prevents it to be read by a network sniffer or proxy? If the URL can be read then I see no security in Shared Access Signatures. So I must be missing the point.

Is there any chance the parameters after the ? in the URL aren't sent and kept for the client? If so, I guess we have to rely on the client security and trust it. Am I right?

Thank you

Improve this question
1
  • It's unclear since pages like this one: technicqa.com/are-url-parameters-encrypted-over-https do state "URLS and query parameters aren’t secure. They should never contain sensitive or important information (passwords, static shared secrets, private information, etc)." Yet, I read parameters after the ? mark aren't sent before the https/TLS handshake is done. So I'm still a bit confused at this point.
    – Ozwel
    Jan 14 at 9:43

1 Answer 1

Reset to default
1

Since you use HTTPS then the SSL/TLS will protect against a network sniffer. The URL cannot be read, but it might be possible to retrieve it from your browsing history - so be aware if you use a shared PC.

An encrypted HTTPS request protects most things: This is the same for all HTTP methods (GET, POST, PUT, etc.). The URL path and query string parameters are encrypted, as are POST bodies. https://https.cio.gov/faq/

https://stackoverflow.com/a/643480/1042624

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .