Signed URLs

Your ASP.NET Core API checks that a user is logged in, then hands back a direct Azure CDN URL pointing to a file in Azure Blob Storage. That URL carries no expiration, and it isn't tied to that user or that request at all.

Anyone who gets hold of that URL, shared with them, posted somewhere public, saved from months ago, can open it directly. It keeps working forever, without ever going through your API or its login check again.

A link with no expiration keeps working forever for whoever has it, long after the request that generated it is over. That's exactly what a signed URL fixes.

A signed URL puts an expiration on the link itself: instead of returning a plain Azure CDN URL, have the API generate a Shared Access Signature (SAS) for the Azure Blob Storage file, with a short expiration, for example a few hours, generating a new one each time rather than reusing one. Azure CDN checks the signature and its expiration on every request, and rejects the URL once it expires.

Use: Azure.Storage.Blobs (BlobSasBuilder)

Give the link its own expiration, so it stops working on its own instead of working forever once it's out.

A concert ticket is stamped for one specific show. It gets you in that night, but it doesn't work the next night, or at a different venue, even if someone else finds the same ticket in a coat pocket months later.

A ticket with no date or show printed on it would let whoever holds it walk into any show, any night, forever.

Valid for one specific use, for a specific window, not a pass that works forever once it exists.