carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby and Python.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Staff Developer Advocate

Carla Urrea Stabile

Learn how to achieve continuous confidence in your authorization logic. This article will guide you on defining OpenFGA test files and integrating them into a robust CI/CD pipeline using GitHub Actions.

Continuous Authorization Testing: FGA, GitHub Actions, and CI/CD 

authstrong

Guest Author

Víctor Moreno

In this article we will learn about the many ways that Microsoft Azure Storage enables us to store information.


## What is Azure Storage?

Azure Storage is the Microsoft solution for cloud storage. Their solution provides four different types of storage:

- [Table Storage](https://docs.microsoft.com/en-us/azure/cosmos-db/table-storage-how-to-use-dotnet)
- [Queue Storage](https://docs.microsoft.com/en-us/azure/storage/queues/storage-dotnet-how-to-use-queues)
- [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs)
- [File Storage](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction)

Before diving into the details about each type, let's talk about *account storages*. An account storage provides a unique namespace for Azure Storage objects. Based on what customers use, Microsoft bills them through their account storages. Every account storage contains a subdomain that is used to access the different storage types. For example, if we had an account storage id called `storagesample` we would get the following subdomain:

- storagesample.blob.core.windows.net
- storagesample.table.core.windows.net
- storagesample.file.core.windows.net
- storagesample.queue.core.windows.net

## What is Azure Table Storage?

Azure Table Storage is a service that stores NoSQL data in the cloud. This storage type enables developers to store schema-less data in a key/value fashion. The main characteristics of Azure Table Storage are:

- Tables are independent of each other.
- Features like foreign keys, joins, and custom indexes don't exist.
- Table schemas are flexible. That is, it's not mandatory to have all fields on all records.

Each table on Azure Table Storage is composed of five main components:

- Entities: We can see these as rows (typical records) on relational databases.
- Partition keys: Strings that contain no more than 1 KB of data. They cover one or more entities in a table, grouping them into blocks of entities that share an ID.
- Row keys: Strings that contain no more than 1 KB of data. They are used to identify rows inside tables uniquely.
- Timestamps: Properties that store when entities were inserted or updated.
- Partitions: Collections of entities in a table. Partitions are identified by their partition key to group them like several tables but inside one object.

![Table Storage structure on Microsoft Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/78pG0FN0kok96vlutuxCN9/69b12f7d1847194cc43dbeb3046a9a17/table-storage)

In the following sections, we will learn how to create tables on Azure Table Storage and how to add entities to them. To see other operations (like table removal or how to update entities), we can check [this Table Storage GitHub repository](https://github.com/vemoreno/TableStorageWithCsharp).

### Creating Tables on Azure Table Storage

In this section, we are going to learn how to create tables on Azure Table Storage. The following C# code snippet shows four easy steps to create a demo table:

```C#
public CloudTable CreateDemoTable()
{
	// 1 - Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);       

  // 2 - Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// 3 - Create the table client.
	CloudTableClient tableClient = storageAccount.CreateCloudTableClient();

	// 4 - Retrieve a reference to the table.
	CloudTable table = tableClient.GetTableReference("Demo");
  table.CreateIfNotExists();

  return table;
}
```

The first step creates an instance of `StorageCredentials`. To do this, we just need to pass our `Account` name and account `Key`. This information can be retrieved as shown in the following screen:

![Retrieving account name and account key from Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/7CX2MQqNms4rnkFYNGuVjf/229300a3d31d78f02d1babbd5fd468f2/6rIuv)

After that we create an instance of `CloudStorageAccount` passing the reference for the `StorageCredentials`. Then, in the third step, we call the `CreateCloudTableClient()` method of our `CloudStorageAccount` to create a new `CloudTableClient`.

Step four consists of using `CloudTableClient` to get a reference to a table called `Demo` and creating it on Azure Table Storage if it doesn't exist.

### Adding Entities to a Table on Azure Table Storage

Now that we know how to create tables on Azure Table Storage, let's learn how to use them to add new entities. In the following example, we use a class called `CustomerEntity`. [The implementation details of this class can be found here](https://github.com/vemoreno/TableStorageWithCsharp/blob/master/AzureTableStorage/AzureTableStorage/Models/MyTableEntity.cs).

```C#
public void AddEntity()
{
  // 1 - retrieve demo table reference from last sample
	CloudTable table = CreateDemoTable();

	// 2 - create an instance of CustomerEntity
	CustomerEntity customer = new CustomerEntity("Harp", "Walter");
	customer.Email = "walter@contoso.com";
	customer.PhoneNumber = "425-555-0101";

	// 3 - insert customer into demo table
	table.Execute(TableOperation.Insert(customer));
}
```

The process to create entities into Azure Table Storage, as we can see, is quite simple. The first step is to retrieve a reference to `CloudTable`. After that, we create a new `CustomerEntity`, with some arbitrary `Email` and `PhoneNumber`. Then, in the third and last step, we instruct `CloudTable` to execute an insert `TableOperation`, passing the customer instance that we just created.

## What is Azure Blob Storage?

Blob, an acronym to "Binary Large OBject", is a collection of binary data that can represent any type of file (like images, videos, documents, programs, etc). Microsoft Azure enables developers to store two types of blobs: *Block Blobs* and *Page Blobs*. In the following sections, we are going to learn about these types and how to store them into Microsoft Azure Storage accounts.

### Block Blobs

[Block Blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs#blob-service-concepts) allow developers to handle big files with efficiency. Block Blobs main features on Azure Storage are:

- A single blob can be divided into many blocks, but can never exceed 50,000 blocks.
- Together, these blocks cannot exceed 200 GB.
- Each block can have a maximum size of 4MB.

![Block Blobs Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/jctwOpTCORYaX2QE5lTcR/6cab09dc477476dc1a1e6062b169f5fb/blob-storage)

### Page Blobs

[Page Blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs#blob-service-concepts) perform incredibly well on random read/write operations. This characteristic makes Page Blobs the perfect solution for virtual machines and OS data disks. Page Blobs main features on Azure Storage are:

- Capacity of 1 TB of size.
- Compound by a collection of 512-byte pages optimized for random read and write operations.
- Each write operation alter several pages at the same time.

![Page Blobs Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/1gZSWBgFdjHoRN0UTnU1xN/89f4909148b41d9144094acd013ea674/page-blob)

### Using Azure Blob Storage

Both Page Blobs and Block Blobs share a concept called *containers*. Some features of containers, in this context, are:

- A container provides a grouping of a set of blobs.
- All blobs must be in a container.
- An account can contain an unlimited number of containers.
- A container can store an unlimited number of blobs. Note that the container name must be lowercase.

The following code snippets show how to create a new container, or how to get the reference to an existing container called `demo-container`:

```C#
public CloudBlobContainer CreateContainer()
{
  // Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);

  // Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create the blob client.
	CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();

	// Retrieve a reference to a container.
	CloudBlobContainer container = blobClient.GetContainerReference("demo-container");

	// Create the container if it doesn't already exist.
	container.CreateIfNotExists();

  return container;
}
```

After creating the container, we can upload a blob to it, as shown in the following snippet:

```C#
public void UploadBlobToContainer()
{
  // Get the "demo-container" container reference
	CloudBlobContainer container = CreateContainer();

	// Retrieve reference to a blob called "myblob".
	CloudBlockBlob blockBlob = container.GetBlockBlobReference("myblob");

	// Create or overwrite the "myblob" blob with contents from a local file
	string fullPath = Path.GetDirectoryName(
    Path.GetDirectoryName(System.IO.Directory.GetCurrentDirectory())
  ) + "pin.png";

	using (var fileStream = System.IO.File.OpenRead(fullPath))
	{
		blockBlob.UploadFromStream(fileStream);
	}
}
```

To learn about other operations—like how to list, download, and delete blobs—take a look into this [GitHub repository](https://github.com/vemoreno/BlobStorageWithCsharp).

## What is Azure Queue Storage?

Microsoft Azure provides instant messaging on the cloud between applications through [Queue Storage](https://azure.microsoft.com/en-us/services/storage/queues/). Due to this service, we can process significant amounts of messages and get access to them from anywhere through HTTP/HTTPS calls. Some features of Queue Storage are:

- Messages can have a maximum size of 64 KB of data.
- Any queue can store millions of messages.
- Great for asynchronous processing.

![Queue Storage Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/6rCs5Jqr5xJh1UbFQNAcuJ/5d1b3bd701a0a74a596949f054b389df/queue-storage)

The following code snippets show how to create a new Queue Storage, or how to get the reference to an existing container called `my-queue`:

```C#
public CloudQueue CreateQueue()
{
  // Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);

  // Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a Queue Storage client
	CloudQueueClient queueClient = storageAccount.CreateCloudQueueClient();

	// Retrieve a reference to a container
	CloudQueue queue = queueClient.GetQueueReference("my-queue");

	// Create the queue if it doesn't already exist
	queue.CreateIfNotExists();

  return queue
}
```

After creating the Queue Storage, we can insert messages into it, as shown in the following snippet:

```C#
public void InsertMessage()
{
	// Retrieve a reference to my-queue
	CloudQueue queue = CreateQueue();

	// Create a message and add it to the queue.
	CloudQueueMessage message = new CloudQueueMessage("Hello, World");
	queue.AddMessage(message);
}
```

To learn about other operations—like how to peek, change, and dequeue messages—take a look into this [GitHub repository](https://github.com/vemoreno/QueueStorageWithCsharp).

## What is Azure File Storage?

Another way of store information on Microsoft Azure is through File Storage. This service offers shared resources in the cloud. Applications executing locally, on virtual machines, or any other service inside Microsoft Azure can mount a shared resource of files in Azure.

File Storage is flexible and can be handled through the following clients:

- Azure Portal.
- PowerShell.
- API Rest.
- Azure Libraries with .Net and other frameworks.

With File Storage, it is possible to replace file systems based on typical servers hosted on-premises environments. File Storage is secure because it uses the Server Message Block (SMB) Protocol and Common Internet File (CIFS).

A "File Share" is an SMB space in Azure. All directories and files must be created in a parent share. An account can contain an unlimited number of shares, and a share can store an unlimited number of files, up to the 5 TB total capacity of the file share.

![File Storage Structure on Azure Store](https://images.ctfassets.net/23aumh6u8s0i/1q3urAew8sT9FPEy0Ix524/6355fd326606dc32d7f9c523b67339c0/file-storage)

The following C# code snippet shows how to interact with File Storage on Azure Storage programmatically:

```C#
public void AccessFileStorage()
{
	// Retrieve storage account from connection string.
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a CloudFileClient object for credentialed access to File storage.
	CloudFileClient fileClient = storageAccount.CreateCloudFileClient();

	// Get a reference to the file share we created previously.
	CloudFileShare share = fileClient.GetShareReference("logs");

	// Ensure that the share exists.
	if (share.Exists())
	{
		// Get a reference to the root directory for the share.
		CloudFileDirectory rootDir = share.GetRootDirectoryReference();

		// Get a reference to the directory we created previously.
		CloudFileDirectory sampleDir = rootDir.GetDirectoryReference("CustomLogs");

		// Ensure that the directory exists.
		if (sampleDir.Exists())
		{
			// Get a reference to the file we created previously.
			CloudFile file = sampleDir.GetFileReference("Log1.txt");

			// Ensure that the file exists.
			if (file.Exists())
			{
				// Write the contents of the file to the console window.
				Console.WriteLine(file.DownloadTextAsync().Result);
			}
		}
	}
}

public void SetMaxSize()
{
	// Parse the connection string for the storage account.
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a CloudFileClient object for credentialed access to File storage.
	CloudFileClient fileClient = storageAccount.CreateCloudFileClient();

	// Get a reference to the file share we created previously.
	CloudFileShare share = fileClient.GetShareReference("logs");

	// Ensure that the share exists.
	if (share.Exists())
	{
		// Check current usage stats for the share.
		// Note that the ShareStats object is part of the protocol layer for the File service.
		Microsoft.WindowsAzure.Storage.File.Protocol.ShareStats stats = share.GetStats();
		Console.WriteLine("Current share usage: {0} GB", stats.Usage.ToString());

		// Specify the maximum size of the share, in GB.
		// This line sets the quota to be 10 GB greater than the current usage of the share.
		share.Properties.Quota = 10 + stats.Usage;
		share.SetProperties();

		// Now check the quota for the share. Call FetchAttributes() to populate the share's properties.
		share.FetchAttributes();
		Console.WriteLine("Current share quota: {0} GB", share.Properties.Quota);
	}
}
```

To learn more about how to deal with File Storage on Azure—like how to access, copy, or manage shared files—take a look into this [GitHub repository](https://github.com/vemoreno/FileStorageWithCsharp).

## Aside: Securing .NET Applications with Auth0

One of the most complex features to implement in an application is [user authentication and identity management](https://auth0.com/user-management). [Security for authentication and identity](https://auth0.com/docs/security) is [an entire glossary](https://auth0.com/identity-glossary) unto itself.

![Auth0 hosted login screen](https://images.ctfassets.net/23aumh6u8s0i/4ve30M1qt7GmE2nAYNKOhs/358e1f9aab4405b66fbeb5ca4cfa1eae/angular-aside-login)

If we need to implement a robust, highly customizable [identity and access management](https://auth0.com/learn/cloud-identity-access-management/) system quickly and easily for our .NET applications, Auth0 can help. As shown in this [quickstart ASP.NET Web API (OWIN) Authorization](https://auth0.com/docs/quickstart/backend/webapi-owin), we need to perform four simple steps. First, we create a Resource Server (API) in our Auth0 account.

![Create a Resource Server (API)](https://images.ctfassets.net/23aumh6u8s0i/pkl7oy76Iowh7JjqxujBT/4749a50a68abea34164fcca448e3c6c3/create-api.png)

Then we update the `web.config` file in our project with the correct Domain and API Identifier for our API, e.g.

```xml
<appSettings>
  <add key="Auth0Domain" value="bkrebs.auth0.com" />
  <add key="Auth0ApiIdentifier" value="https://bkrebs.auth0.com/api/v2/" />
</appSettings>
```

After that, we install two NuGet packages:

```bash
Install-Package Microsoft.Owin.Security.Jwt
Install-Package Auth0.OpenIdConnectSigningKeyResolver
```

And then we update the `Configuration` method of our `Startup` class to add a call to `UseJwtBearerAuthentication` passing in the configured `JwtBearerAuthenticationOptions`.

```C#
// Startup.cs

public void Configuration(IAppBuilder app)
{
    var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
    var apiIdentifier = ConfigurationManager.AppSettings["Auth0ApiIdentifier"];

    var keyResolver = new OpenIdConnectSigningKeyResolver(domain);
    app.UseJwtBearerAuthentication(
        new JwtBearerAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Active,
            TokenValidationParameters = new TokenValidationParameters()
            {
                ValidAudience = apiIdentifier,
                ValidIssuer = domain,
                IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) => keyResolver.GetSigningKey(identifier)
            }
        });

    // Configure Web API
    WebApiConfig.Configure(app);
}
```

[The full set of instructions on how to use Auth0 to secure ASP.NET Web APIs (OWIN) can be found here](https://auth0.com/docs/quickstart/backend/webapi-owin). Auth0 also can be easily integrated with [ASP.NET Core Web API](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi) and [a lot of other platforms and frameworks](https://auth0.com/docs).

## Frequently Asked Questions

As we can see, Azure Storage offers developers multiple ways to store information in the cloud. Now that we know a little bit more about Azure Storage, let's look into some frequently asked questions:

### When should we use Table Storage?

Table Storage is useful when we don't need to store data that are linked to each other, like tables on a relational database. Table Storage does support tables, but their schema is flexible and we cannot join different tables through queries. To achieve similar results, we need to this in memory.

### When should we use Blob Storage?

Block blobs are ideal for storing text or binary files, such as documents and media files. Append blobs are similar to block blobs in that they are made up of blocks. Though, as they are optimized for append operations, they are useful for logging scenarios.

Page blobs can have up to 1 TB of data and are more efficient for frequent read/write operations. Azure Virtual Machines use page blobs as their main storage.

### When should we use Queue Storage?

Queue Storage helps developers to create scalable applications that are less sensitive to individual component failure. If part of our architecture goes down, messages are buffered, and then naturally picked up by other message processing nodes, which maintains the integrity of workload.

### When should we use File Storage?

File Storage is a great way to share files in the cloud. It uses HTTPS and SMB to secure data at rest and in-transit and the access to Storage Account is restricted to users having access to Storage Account Key.


Azure Storage Introduction

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

The CWI Institute and Google have successfully demonstrated a practical SHA-1 collision attack by publishing two unique PDF files that produce the same hash value.



---

**TL;DR** Researchers published a technique for causing SHA-1 collisions and demonstrated it by providing two unique PDF documents that produced the same SHA1 hash value.

---

[Secure Hash Algorithm 1](https://en.wikipedia.org/wiki/SHA-1) or SHA-1 is a cryptographic hash function designed by the United States [National Security Agency](https://www.nsa.gov/) and released in 1995. The algorithm was widely adopted in the industry for digital signatures and data integrity purposes. For example, applications would use SHA-1 to convert plain-text passwords into a hash that would be useless to a hacker, unless of course, the hacker could reverse engineer the hash back into the original password, which they could not. As for data integrity, an SHA-1 hash ensured that no two files would have the same hash, and even the slightest change in a file would result in a new, completely unique hash.

According to [Wikipedia](https://en.wikipedia.org/wiki/Cryptographic_hash_function), the ideal cryptographic hash function has five main properties:

* It is deterministic so the same message always results in the same hash.
* It is quick to compute the hash value for any given message.
* It is infeasible to generate a message from its hash value except by trying all possible messages.
* A small change to a message should change the hash value so extensively that the new hash value appears uncorrelated with the old hash value.
* **It is infeasible to find two different messages with the same hash value.**

In 2005, researchers discovered potential [vulnerabilities](http://www.darkreading.com/vulnerabilities---threats/researchers-warn-against-continuing-use-of-sha-1-crypto-standard/d/d-id/1322565) in the SHA-1 algorithm and by 2010 many organizations stopped it as it was deemed [insecure](https://www.entrust.com/understanding-sha-1-vulnerabilities-ssl-longer-secure/). The potential vulnerabilities had not been proven, until today, when CWI Institute and Google demonstrated a practical collision attack against SHA-1. The researchers were able to provide two unique PDF files that produced the same exact SHA-1 hash value.

> Auth0 can improve software security with the breached password detection feature. [This feature protects and notifies your users when their credentials are leaked by a data breach of a third party](https://auth0.com/breached-passwords). You can optionally prevent access until the user has reset their password.

![Data Integrity](https://images.ctfassets.net/23aumh6u8s0i/6C5jFby0JGDlbZ7q8iBkkr/d0d3957803a2ca66d39903e4b500b395/example)

<p><small>Source: <a href="http://shattered.io/static/infographic.pdf" target="_blank">shattered.io</a></small></p>

The team published a practical technique showing how to generate a collision bringing the fears that SHA-1 was insecure to reality. The technique outlined required years of research and immense computation resources. From the research published, it would take a cluster of 110 powerful GPU’s running computations 24 hours a day for an entire year to cause a collision or about 6,500 years on a single-CPU. So while this attack vector is fairly impractical, it is not impossible.

<include src="TweetQuote" quoteText="The SHA1 collision attack required 9,223,372,036,854,775,808 SHA1 computations."/>

This is a big deal because even though many organizations have stopped using SHA-1, underlying systems still often rely on SHA-1. Software updates, ISO checksums, PGP signatures, digital certificate signatures, git, and others still make use of SHA-1 for data integrity. If a malicious party were able to create a collision for a popular piece of software, for example, and distributed it on the web, they could infect many unsuspecting users causing all sorts of damage.

On the bright side, the typical user does not have to worry too much. Certification Authorities are forbidden from issuing SHA-1 certificates, and Google and Mozilla will warn users accessing HTTPS websites that use SHA-1 signed certificates. More and more organizations are using safer alternatives like SHA-256 for their cryptographic needs. Additionally, since the published attack vector has only been proven with PDF files, the team created a website, [shattered.io](https://shattered.io), which allows you to test your PDF files and see if they could have been compromised.

For most, security is not actively thought about, but for us at [Auth0](https://auth0.com), security is the only thing we think about. Ok, not the only thing, but it’s up there. In addition to embracing open authentication standards like [OAuth](https://tools.ietf.org/html/rfc6749) and [OpenID](http://openid.net/), we follow industry standards and best practices for security and when this popped up on our radar we just had to share it. Learn more about our security practices [here](https://auth0.com/security).

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

For more info on the SHA-1 collision attack, be sure to check out [shattered.io](http://shattered.io/) and Google’s Security Blog [post](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html). If you are using SHA-1, please switch to a more secure hashing algorithm like [SHA-256](https://en.wikipedia.org/wiki/SHA-2).


"file"