Search code examples
javascriptazurecordova

Download azure blob using purely javascript and no Nodejs?

I have a cordova application which downloads a zip file as blob from azure. Since I am very new to azure, I would like to know that is it okay security wise to access azure blob with SAS url from the cordova application ?

My point is that I would need to append the shared access signature (SAS) token to the blob url, something like below. 

https://myazureportal.container.blobs/myblob?MY_SAS

This way my javascript code will have SAS hard-coded. What is the correct approach since I would prefer to access blob using javascript only and preferably without writing any server side code if possible ?

if I use SAS inside javascript files of my cordova application, is it a security flaw ? If so, any approach to implement the same using purely javascript only ?

Things I tried:

  1. Created a back-end WEB-API service in ASP.NET Core and this way, I would be able to download the blob file but I am looking for is a pure javascript approach.
Solution

  • Yes it is a security flaw as your app can be decompiled and your code inspected. If you want to keep this approach, at least have a login connected to a back-end that sends the SAS back to your front-end. Ideally you would do everything in the back-end and return the blob to your front-end.