Azure Storage Emulator 403 Forbidden

Question

Via Nuget, I upgraded WindowsAzure.Storage to 8.1.1.

I then downloaded the AzureStorageEmulator 5.1.0.0 client.

My connection string:

UseDevelopmentStorage=true;

I've made no code changes since previously when it was apparently working fine. I know get the exception:

Microsoft.WindowsAzure.Storage.StorageException: The remote server returned an error: (403) Forbidden. ---> System.Net.WebException: The remote server returned an error: (403) Forbidden.
   at System.Net.HttpWebRequest.GetResponse()
   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext) in c:\Program Files (x86)\Jenkins\workspace\release_dotnet_master\Lib\ClassLibraryCommon\Core\Executor\Executor.cs:line 677
   --- End of inner exception stack trace ---
   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext) in c:\Program Files (x86)\Jenkins\workspace\release_dotnet_master\Lib\ClassLibraryCommon\Core\Executor\Executor.cs:line 604
   at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.CreateIfNotExists(BlobContainerPublicAccessType accessType, BlobRequestOptions requestOptions, OperationContext operationContext) in c:\Program Files (x86)\Jenkins\workspace\release_dotnet_master\Lib\ClassLibraryCommon\Blob\CloudBlobContainer.cs:line 233
   at C3.Code.Controls.Application.Storage.Blob.Blob.GetContainer(String containerName) in C:\Dropbox\Dropbox (Scirra Ltd)\Tom\C3 Website\C3Alpha2\Code\Controls\Application\Storage\Blob\Blob.cs:line 112
Request Information
RequestID:621bc19f-eb6a-4a98-b19e-f5b01ac22c26
RequestDate:Thu, 27 Apr 2017 16:17:34 GMT
StatusMessage:Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
ErrorCode:AuthenticationFailed
ErrorMessage:Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:621bc19f-eb6a-4a98-b19e-f5b01ac22c26
Time:2017-04-27T16:17:34.5166522Z

When I call

var blobClient = GetClient();
var container = blobClient.GetContainerReference(containerName);
container.CreateIfNotExists(BlobContainerPublicAccessType.Blob);

I saw that system time can impact this, so I checked:

Server DateTime.UtcNow = 27/04/2017 16:17:34
Exception RequestDate = Thu, 27 Apr 2017 16:17:34 GMT

Any ideas why I'm seeing this error after updating the client and the nuget package?

Edit: GetClient() Code:

private static CloudBlobClient GetClient()
{
    var account = CloudStorageAccount.Parse(Settings.Deployment.AzureConnectionString);
    return account.CreateCloudBlobClient();
}

Edit: BaseUri

Base URI is: http://127.0.0.1:10000/devstoreaccount1

Visit this I get:

<Error>
<Code>InvalidQueryParameterValue</Code>
<Message>
Value for one of the query parameters specified in the request URI is invalid. RequestId:9cc906b0-eec6-44b2-bb3d-f77020af4a4c Time:2017-04-27T16:43:16.8538679Z
</Message>
<QueryParameterName>comp</QueryParameterName>
<QueryParameterValue/>
<Reason/>
</Error>

During storage emulator init, it shows it's installed it to:
(localdb)\MSSQLLocalDB as AzureStorageEmulatorDb51

Visiting: http://127.0.0.1:10000/azurestorageemulatordb51

Shows:

<Error>
<Code>OutOfRangeInput</Code>
<Message>
One of the request inputs is out of range. RequestId:dab5e6c1-bc4a-4c65-a4d9-6d44634cb36a Time:2017-04-27T16:47:20.3093597Z
</Message>
</Error>

Shell

In your exception stack trace why the time on request date is 15:01? Could this be the reason for this error? – Evyn

@GauravMantri updated question, sorry pulled from another error message. All the dates appear to be the same (Datetime.UtcNow, Exception RequestDate) – Shell

Have u checked that the emulator has started ? – Tawnytawnya

Also azure storage emulator uses local db for metadata ,make sure that u can connect to it in sql to see that db – Tawnytawnya

Let us continue this discussion in chat. – Shell

Do we have a resolution here yet? – Tawnytawnya

A couple more things to check: Try running against a production storage account instead of the emulator. Try sending the request through fiddler to see if extra headers are getting added. Some versions off app insights add headers that cause storage authentication to fail. – Earmark

@MichaelRoberson-MSFT set up a test account on Azure, used that as connection string and worked fine. Appears to be an issue with this computer then I guess? – Shell

Answer 1

I had the same problem and also tried downgrading WindowsAzure.Storage without success. After a long day of trying to disable everyting I discovered that removing this line from startup.cs fixed the problem:

services.AddApplicationInsightsTelemetry(configuration);

I don't know why these are related and why ApplicationInsights causes problems for Azure storage. I have tried using both version 2.1.0-beta2 and 2.0.0 of Microsoft.ApplicationInsights.AspNetCore and both cause the 403 error.

Biology

We just got this today when upgrading to 2.4 of AppInsights – Lisandralisbeth

I just hit this problem with the local emulator. Does this happen for just the local emulator or in Azure as well? – Palladium

I downgraded Microsoft.ApplicationInsights.AspNetCore from 2.1.0 to 2.0.1 to get around this issue. – Palladium

I started having this problem after upgrading to Microsoft.ApplicationInsights 2.4.0. Solved by downgrading to 2.3.0. – Neopythagoreanism

This issue is fixed in ASP.NET Core v2.1.1: github.com/Microsoft/ApplicationInsights-aspnetcore/releases/… – Rattlesnake

Answer 2

You can resolve this issue for Application Insights version 2.4.0 by modifying the ApplicationInsights.config file and adding the localhost in to the ExcludeComponentCorrelationHttpHeadersOnDomains section thus:

<ExcludeComponentCorrelationHttpHeadersOnDomains>
    <Add>localhost</Add>
    <Add>127.0.0.1</Add>
    <Add>core.windows.net</Add>
    <Add>core.chinacloudapi.cn</Add>
    <Add>core.cloudapi.de</Add>
    <Add>core.usgovcloudapi.net</Add>
</ExcludeComponentCorrelationHttpHeadersOnDomains>

Beene

Updating to 2.4.1 didn't work for me. However this config change did. Just need to remember to de-do it after the next NuGet update – Gladiator

de-do! :D love it! – Octaviaoctavian

Answer 3

Upgrading Application Insights from version 2.4 to 2.4.1 solved this issue.

Note: when I chose to add AI to my project (using wizard), version 2.4 was added. Surprisingly, the version added was not the latest AI version. I had to go to NuGet and to manually upgrade to latest version.

Latty

Here also ApplicationInsights caused the problem after Upgrading Azure Storage Emulator to 5.10. Resolved it by updating ApplicationInsights from 2.4.0 to 2.10.0 (todays latest version). – Authoritarian

Answer 4

I've had the same problem, could not find any solution to fix that. It really seems to be connected to ApplicationInsights - direct call to the local emulator from a clean console application works fine, calling the emulator from a web project with ApplicationInsights returns 403.

You can use another storage emulator or use a real Azure Blob Storage.

Judah

Answer 5

We had the same issue after installing the Application Insights package into our business rules project. We have an N-tier solution with asp.net core, which has a different version of application insights.

It turns out we installed the non asp.net core package into the business rules, which then produced the Forbidden 403 error when accessing Queue Client.

We removed the non asp.net core application insights, installed the application insights core into the business rules project and all worked ok.

Rochester

Upgraded to Application Insights 2.4 and got this error, downgrading to 2.3 fixed it for me – Love

Actually we also downgraded our business rules package to 2.3 version at the same time (which was the same version as the .net core project). It previously was Application Insights 2.4. I had forgotten about that step! – Rochester

Answer 6

For those who don't see

services.AddApplicationInsightsTelemetry(configuration);

in their Startup.cs file, the ApplicationInsight configuration might be done in Program.cs, like so:

var host = new WebHostBuilder()
    .UseKestrel()
    .UseContentRoot(Directory.GetCurrentDirectory())
    .UseIISIntegration()
    .UseStartup<Startup>()
    .UseApplicationInsights() /* HERE */
    .Build();

Patrickpatrilateral