Receiving 403 AuthenticationFailed error instead of 400 Bad-Request!

[ralphie97]

• Package Name: @azure/storage-blob, @azure/identity
• Package Version: 12.3.0, 1.2.0
• Operating system: Windows 10
• nodejs
  • version: v14.16.0
• browser
  • name/version:
• typescript
  • version: v1.5.3
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://docs.microsoft.com

Describe the bug

For uploadPages and appendBlock operations, if the contentLength doesn't match the actual length of the body we get 403 AuthenticationFailed error. This seems like a Bad request payload and thus should have given 400.

Hence we cannot differentiate between Permission-related error and the Bad-Request error, in case of the above-mentioned operations.

To Reproduce
Steps to reproduce the behavior:

Below is the sample code for appendBlock:

const { BlobServiceClient, StorageSharedKeyCredential } = require('@azure/storage-blob')
const fs = require('fs')

const account = '<<account>>'
const accountKey = '<<key>>'
const sharedKeyCredential = new StorageSharedKeyCredential(account, accountKey)

const blobServiceClient = new BlobServiceClient(
  `https://${account}.blob.core.windows.net`,
  sharedKeyCredential
)

const containerName = '<<container>>'

async function main () {
  try {
    const fileContent = fs.readFileSync('<<file-path>>')
    console.log('$$$$$$$$$$ fileconetnt length $$$$$$$$$$$$$  ::  ', fileContent.length)
    const containerClient = blobServiceClient.getContainerClient(containerName)
    const blobName = '<<blob>>'
    const appendBlobClient = containerClient.getAppendBlobClient(blobName)
    const uploadBlobResponse = await appendBlobClient.appendBlock(fileContent, fileContent.length + 1)
    console.log(`Upload block blob ${blobName} successfully`, uploadBlobResponse)
  } catch (err) {
    console.log('Error while appending file content to append blob :  ', err)
  }
}

main()

Expected behavior

Since we are providing an incorrect payload, we should receive a Bad-Request error with 400 statusCode.

[EmmaZhu]

@ralphie97

Thanks a lot for reporting this to us. This issue may because: the SDK uses content length in header to do signature, while storage service uses the actual content length for request body. We will fix this.

Does this issue blocks your scenario? Do you have a work around?

Thanks
Emma

[ralphie97]

@EmmaZhu

Currently, this acts as a blocker and we don't have a workaround.
When can we expect the fix?

Thanks
Nikhil

[EmmaZhu]

@ralphie97 ,

Do you need a released package, or a fix in master branch code also works for you?

Thanks
Emma

[EmmaZhu]

Hi @ralphie97

My proposed fix is to set the Content-Length as the actual length of the body, which won't cause 403 or 400 error because of the mismatch content length. Does this fix work for your solution?

Thanks
Emma

[ralphie97]

@EmmaZhu

A released package will suffice.

And regarding the fix, what should be expected if the content-length provided doesn't match the body-length. Does the body gets truncated?

Thanks
Nikhil

[EmmaZhu]

@ralphie97 ,

If the content-length provided doesn't match the body-length, we would propose to set value of content-length as body-length. This way, the uploading request will succeed.

Thanks
Emma

[ralphie97]

@EmmaZhu

What if the content-length provided is smaller than the actual body-length?

[EmmaZhu]

The SDK won't truncate request. Our proposal is to try to set the content-length to the correct value (actual body length), no matter whether content length is larger/smaller than actual body length. What do you think?

Thanks
Emma

[ralphie97]

@EmmaZhu

That seems fine.
Can you please let us know by when this fix will be available with the general release?

Thanks
Nikhil

[EmmaZhu]

#20074