CODEWITHSUNDEEP
restazureazure-storage-queues
TheDude
TheDude

Reputation: 1531

Azure Storage Service throws 403 forbidden error when trying to call REST API to clear queue messages

I'm trying to clear all azure storage queue message via Queue Service REST API. I've verified that the code is correct, but it still returns a 403 forbidden error. The "StorageSharedKey" and "StorageAccountName" are correct since I'm able to connect to the azure queue using those values in the connection string for the azure queue client. The storage version I'm using is "2015-12-11".

Here is the code:

    internal void ClearStorageQueueMessages(string queueName)
    {
        const string requestMethod = "DELETE";
        string urlPath = $"{queueName}/messages";
        var dateInRfc1123Format = DateTime.UtcNow.ToString("R", CultureInfo.InvariantCulture);
        var canonicalizedHeaders = $"x-ms-date:{dateInRfc1123Format}\nx-ms-version:{StorageVersion}";
        var canonicalizedResource = $"/{StorageAccountName}/{urlPath}";
        var uri = new Uri($"https://{StorageAccountName}.queue.core.windows.net/{urlPath}");
        var response = MakeDeleteRestCall(uri, requestMethod, dateInRfc1123Format, canonicalizedHeaders, canonicalizedResource);
    }

    internal RestResponse MakeDeleteRestCall(Uri uri, string requestMethod, string dateInRfc1123Format, string canonicalizedHeaders,
        string canonicalizedResource)
    {
        var restResponse = new RestResponse();
        var stringToSign = $"{requestMethod}\n\n\n\n\n\n\n\n\n\n\n\n{canonicalizedHeaders}\n{canonicalizedResource}";
        var authorizationHeader = CreateAuthorizationHeader(stringToSign);

        var request = (HttpWebRequest) WebRequest.Create(uri);
        request.Method = requestMethod;
        request.Headers.Add("x-ms-date", dateInRfc1123Format);
        request.Headers.Add("x-ms-version", StorageVersion);
        request.Headers.Add("Authorization", authorizationHeader);
        //request.Accept = "application/atom+xml,application/xml";
        request.Accept = "application/json";
        //request.ContentType = "application/json";

        using (var response = (HttpWebResponse) request.GetResponse())
        {
            restResponse.StatusCode = response.StatusCode;
            var responseStream = response.GetResponseStream();
            if (responseStream == null)
                return restResponse;
            using (var reader = new StreamReader(responseStream))
            {
                restResponse.ReturnedContent = reader.ReadToEnd();
            }
        }
        return restResponse;
    }

    internal static string CreateAuthorizationHeader(string canonicalizedString)
    {
        string signature;

        using (var hmacSha256 = new HMACSHA256(Convert.FromBase64String(StorageSharedKey)))
        {
            var dataToHmac = Encoding.UTF8.GetBytes(canonicalizedString);
            signature = Convert.ToBase64String(hmacSha256.ComputeHash(dataToHmac));
        }

        var authorizationHeader = string.Format(CultureInfo.InvariantCulture, "{0} {1}:{2}", StorageSharedKey,
            StorageAccountName, signature);

        return authorizationHeader;
    }

Upvotes: 0

Views: 1183

Answers (1)

marcelion
marcelion

Reputation: 76

The problem seems to be with the header Authorization. Please check the format according to the documentation:

Authorization="[SharedKey|SharedKeyLite] :"

https://msdn.microsoft.com/en-us/library/azure/dd179428.aspx

Your function adds the shared key in plain text instead of the authorization scheme "SharedKey" or "SharedKeyLite".

Upvotes: 1

Related Questions