Static website in Azure Blob Storage: How to enable Azure AD Authentication?

Question

I am hosting a static website through the $web container in the BLOB storage of an azure storage account. The minified JS in that container contains sensitive data, for example an azure-tables key.

According to the documentation:

You can modify the public access level of the $web container, but this has no impact on the primary static website endpoint because these files are served through anonymous access requests. That means public (read-only) access to all files.

Is there any way to limit access to the website's content (especially the minified JS sitting in the $web container)?

Answer 1

First of all, it is very bad practice to store data access tokens in the website's code, no matter how minified the JS is. The access tokens could be leaked by anyone who has read access to the website, intentionally or unintentionally. That includes being able to open and view the site in their browser.

If you're already thinking about authentication, an Azure Blob Storage service isn't going to cut it. You're probably going to need a free Azure Web App or two (One for the frontend, one for the backend). Server-Side code is much safer than browser code and enables features like proper user input validation. Additionally, enabling Azure AD Authentication is just a click away if you're using Azure Web Apps.

It is possible to generate SAS tokens that require the user to authenticate via Azure AD before accessing the Blob, but I personally haven't tried that yet.