Question

I am trying to generate shared access key for a container through code below

string sas = azureContainer.GetSharedAccessSignature (new SharedAccessPolicy ()
{
    SharedAccessStartTime =  DateTime.UtcNow,
    SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1),
    Permissions = SharedAccessPermissions.Write | SharedAccessPermissions.Read
});

the shared access signature works fine in this case. Client successfully uploads a file on container. But if I set time more than 1 hour (for example 2) I get an exception while trying to upload file on client side saying

Server failed to authenticate the request. Make sure the value of
Authorization header is formed correctly including the signature.

Similarly if I try to set it DateTime.UtcNow.AddMinutes(61) I get the same exception. Any time less than or equal to 60 minutes works fine.

My question: Is the maximum time for a shared access signature is 60 minutes? I didn’t find any such thing in any documentation.

Answer 1

Actually this is documented: CloudBlob.GetSharedAccessSignature Method (SharedAccessPolicy)

… You can specify it on a single shared access signature. In this
case, the interval over which the signature may be valid is limited to
one hour. …

If you want it to be longer than one hour, I suggest you use a container level access policy instead (which can also be revoked).