Skip to content

fix(services/azblob): authorize copy source with the configured SAS token - #8438

Open
YuangGao wants to merge 2 commits into
apache:mainfrom
YuangGao:fix/azblob-sas-copy
Open

YuangGao wants to merge 2 commits into
apache:mainfrom
YuangGao:fix/azblob-sas-copy

Conversation

@YuangGao

Copy link
Copy Markdown
Contributor

Which issue does this PR close?

N/A.

Rationale for this change

With a SAS token, azblob copy fails with CannotVerifyCopySource: Copy Blob sends the bare source URL in x-ms-copy-source, and Azure authorizes the source separately from the request URI, which is the only place the SAS gets appended. The block-based copier path already signs its source; the single Copy Blob path doesn't.

What changes are included in this PR?

  • Append the configured sas_token to the Copy Blob source URL.

Verified against a real storage account (no hierarchical namespace): with a config SAS token, 13 copy and copier behavior tests fail on main with CannotVerifyCopySource and pass here; the full suite goes from 120 to 134 passed. Config account key shows no regression. A SAS token from the environment is not covered, same as #8432.

Are there any user-facing changes?

azblob copy now works with a SAS token.

Breaking changes

AI Usage Statement

AI-assisted implementation.

@YuangGao
YuangGao requested a review from Xuanwo as a code owner October 29, 2026 03:11
@github-actions github-actions Bot added releases-note/fix The PR fixes a bug or has a title that begins with "fix" services/azblob size:XS This PR changes 0-9 lines, ignoring generated files. labels Oct 29, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

releases-note/fix The PR fixes a bug or has a title that begins with "fix" services/azblob size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant