How to authenticate azurite REST API table storage?

Question

I am trying to make a request to the Azurite api from a cypress test. I understand I need an authentication header and I tried using a nodejs script to generate the header. I keep getting an Unauthorized error when I try to query a table. I am not using the default ports for azurite but I'm not sure how that would affect this.

Request (I'm using Postman):

curl --location 'http://localhost:10012/devstoreaccount1/AuditLogs' \
--header 'Date: Mon, 10 Mar 2025 09:49:14 GMT' \
--header 'x-ms-version: 2025-01-05' \
--header 'Authorization: SharedKey devstoreaccount1:ttvHEM3DX/mmZ6LIMHEMEbNbS0SrR1UD+DLv6ej8+Tk=' \
--header 'Accept: application/json;odata=nometadata'

Node script for generating the auth code

const crypto = require('crypto');

const accountName = 'devstoreaccount1';
const accountKey = 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==';
const tableName = 'AuditLogs';
const date = new Date().toUTCString(); // Must be present in the request

// Canonicalized resource format for Table Storage
const canonicalizedResource = `/${accountName}/${tableName}`;

// Correct string-to-sign format for Table Storage
const stringToSign = `GET\n\n\n${date}\n${canonicalizedResource}`;

// Compute HMAC-SHA256 signature using the account key
const key = Buffer.from(accountKey, 'base64');
const hmac = crypto.createHmac('sha256', key);
hmac.update(stringToSign);
const signature = hmac.digest('base64');

// Construct the Authorization header
const authorizationHeader = `SharedKey ${accountName}:${signature}`;

console.log(`Date: ${date}`); // Ensure this is set in the request
console.log(`Authorization: ${authorizationHeader}`);

Check if below provided solution works for you? Let me know if I can be helpful here anyway with further input? — Venkatesan
– Venkatesan, Commented Mar 17 at 9:06

Venkatesan · Accepted Answer · 2025-03-13 12:27:49Z

How to authenticate azurite REST API table storage?

I agree with above Gaurav Mantri' answer you need to add the account name twice in the canonicalized resource name.

You can query tables and entities by following this Microsoft document.

In your code, I noticed that you are passing only the table name in your request. It should be <TableName>()

You can use the code below to query tables in an Azurite environment without needing Postman.

Code:

const axios = require('axios');
const crypto = require('crypto');

const storageAccountName = 'devstoreaccount1';
const storageKey = 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==';

const url = `http://127.0.0.1:10002/${storageAccountName}/table1()`; // table name with ()
const version = '2025-01-05'; // x-ms-version
const date = new Date().toUTCString();
const parameters = 'table1()';

const canonicalizedResources = `/${storageAccountName}/${storageAccountName}/${parameters}`;
const canonicalizedHeaders = `x-ms-date:${date}`;
const stringToSign = `${date}\n${canonicalizedResources}`;

const signature = crypto
    .createHmac('sha256', Buffer.from(storageKey, 'base64'))
    .update(stringToSign, 'utf8')
    .digest('base64');

const headers = {
    'x-ms-date': date,
    'x-ms-version': version,
    'Authorization': `SharedKeyLite ${storageAccountName}:${signature}`,
    'Accept': 'application/json;odata=nometadata'
};

axios.get(url, { headers })
    .then(response => {
        console.log(response.status, response.data);
    })
    .catch(error => {
        console.error(error.response ? error.response.data : error.message);
    });

Output:

200 {
  value: [
    {
      PartitionKey: 'Name',
      RowKey: 'MS Dhoni',
      property1: 'Captain',
      Timestamp: '2025-03-13T09:32:02.9141377Z'
    },
    {
      PartitionKey: 'sample',
      RowKey: 'test',
      property1: 'demo',
      Timestamp: '2025-03-13T09:31:43.0202460Z'
    }
  ]
}

enter image description here

Reference: Authorize with Shared Key (REST API) - Azure Storage | Microsoft Learn

Gaurav Mantri · Accepted Answer · 2025-03-12 19:57:54Z

0

Based on the documentation here, when connecting to Azurite, the account name must appear twice in the canonicalized resource name.

Please use the following code:

const canonicalizedResource = `/${accountName}/${accountName}/${tableName}`;

and that should solve the problem.

answered Mar 12 at 19:57

Gaurav Mantri

137k17 gold badges247 silver badges282 bronze badges

Comments

Sora Teichman · Accepted Answer · 2025-03-17 10:58:45Z

Here's my updated script that finally worked, thanks to your help! I had to put the account name twice in the resources, add parentheses to the table name and update the stringToSign a bit, I had the word GET which was unnecessary.

const crypto = require('crypto');

const accountName = 'devstoreaccount1';
const accountKey = 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==';
const tableName = 'AuditLogs()';
const date = new Date().toUTCString();

const canonicalizedResource = `/${accountName}/${accountName}/${tableName}`;

const stringToSign = `${date}\n${canonicalizedResource}`;

const signature = crypto
    .createHmac('sha256', Buffer.from(accountKey, 'base64'))
    .update(stringToSign, 'utf8')
    .digest('base64');

const authorizationHeader = `SharedKeyLite ${accountName}:${signature}`;

console.log(`Date: ${date}`);
console.log(`Authorization: ${authorizationHeader}`);

Collectives™ on Stack Overflow

How to authenticate azurite REST API table storage?

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related