Search code examples
azureazure-blob-storagepre-signed-urlazure-cdn

Azure CDN with SAS token caching mechanism


I have a blob container with restricted public access. Azure CDN is set up on top of it. Please find the below example

Cache Duration: 24 hours

Azure Storage URL: http://azstorage5.blob.core.windows.net/images/img15.jpg

CDN Endpoint: http://az507925.vo.msecnd.net/

Azure Storage SAS parameter: ?st=2020-12-07T19%3A21%3A09Z&se=2020-12-08T20%3A21%3A09Z&sr=c&sp=r&sig=STTE1p0ujzZr31ZjPaOlNoImCPcjss2GoRsOWDlpJuI%3D

Final CDN URL: http://az507925.vo.msecnd.net/images/img1.jpg?st=2020-12-07T19%3A21%3A09Z&se=2020-12-08T20%3A21%3A09Z&sr=c&sp=r&sig=STTE1p0ujzZr31ZjPaOlNoImCPcjss2GoRsOWDlpJuI%3D

If I set cache behavior as Ignore query strings in the CDN

Question: For the first time when tried to access the image img15.jpg, it will be retrieved from blob container and is cached in CDN. If I access the img15.jpg multiple times with different valid SAS tokens within the cache expiration(24 hours) period, will it be served from cache or will it fetch from blob container for every unique valid SAS token?

End Goal: I want the image to be cached on the CDN and should be able to access it with valid SAS tokens but without hitting the blob container as long as the cache is not expired. Is this a possible use case scenario?


Solution

  • For your question, if using different valid SAS token for a same blob(like blob1), the blob1 with different SAS token will be directly fetched from blob container for the first time of access.

    For example, access by using blob1?sastoken1 first, then access by using blob1?sastoken2, at this time, the blob1?sastoken2 will be fetched directly from blob container.

    I suggest you can use the same sastoken, or you can define a stored access policy to visit the blob.