[BUG] BlobContainerClient throws Azure.RequestFailedException 409 if container already exists but account disallows public access

Library name and version

Azure.Storage.Blobs 12.10.0

Describe the bug

Attempting to run this snippet on an existing container in a storage account that disallows public access:

BlobContainerClient cloudBlobContainer = this.BlobServiceClient.GetBlobContainerClient(strContainerName); await cloudBlobContainer.CreateIfNotExistsAsync(PublicAccessType.Blob);

throws an Azure.RequestFailedException: “409: Public access is not permitted on this storage account”.

Expected behavior

The method should end execution if the container exists without throwing an Azure.RequestFailedException due to public access level settings.

Actual behavior

The method throws an Azure.RequestFailedException at the Create step, although the container already exists.

Reproduction Steps

1. Set a storage account to disallow public access.
2. Call CreateIfNotExistsAsync with PublicAccessType.None on a container that already exists within the storage account; set to private access only.

Environment

Code written in package targeting .NET Standard 2.0

Used in Azure function hosted in Windows Runtime 3.13.1.0

Developed in Visual Studio 17.3.1

[amnguye]

That’s a security issue. Authorization should always be checked over performing the action.

If someone can check the existence of a container, without having the authorization, then anyone publicly poke at storage account to see if a container exists.

[Aussiemon]

This may be as-designed, but it is not intuitive behavior. The method name suggests the first condition is the container’s existence. The public access level check and resulting RequestFailedException should only occur when the container does not exist and needs to be created.

Without this change, the flow seems out of order:

Can we create -> Do we need to create -> Create container

but the expected flow is:

Do we need to create -> Can we create -> Create container

Perhaps this is a difference of opinion though, so I’m closing the bug.