Upgrading JS SDK Azure blob storage gives error

Question

Upgrading JS SDK Azure blob storage gives error

Vasile 20

Hello, i periodicaly update my project deps and i upgraded the @azure/storage-blob package.

Was before update

    "@azure/identity": "^4.10.2",
    "@azure/storage-blob": "^12.27.0",

After update

 "@azure/identity": "^4.11.1",
 "@azure/storage-blob": "^12.28.0",

My code:

  async getSaSToken(blobName: string): Promise<string> {
    const { startTime, expirationTime, userDelegationKey } =
      await this.getUserDelegationKey(this.THIRTY_MINUTES);

    const sasOptions: BlobSASSignatureValues = {
      blobName,
      containerName: BlobContainerNamesEnum.UPLOADS,
      permissions: BlobSASPermissions.parse('r'),
      protocol: SASProtocol.Https,
      startsOn: startTime,
      expiresOn: expirationTime,
    };

    const sasToken = generateBlobSASQueryParameters(
      sasOptions,
      userDelegationKey,
      this.storageAccountConfig.name,
    ).toString();

    return `${this.blobStorageUrl}/${BlobContainerNamesEnum.UPLOADS}/${blobName}?${sasToken}`;
  }


  private async getUserDelegationKey(liveDuration: number): Promise<{
    startTime: Date;
    expirationTime: Date;
    userDelegationKey: ServiceGetUserDelegationKeyResponse;
  }> {
    const NOW = new Date();
    const startTime = new Date(NOW.valueOf() - this.TEN_MINUTES);
    const expirationTime = new Date(NOW.valueOf() + liveDuration);

    const userDelegationKey: ServiceGetUserDelegationKeyResponse =
      await this.blobServiceClient
        .getUserDelegationKey(startTime, expirationTime)
        .catch((error) => {
          this.logger.error(error, error.stack);
          throw new InternalServerErrorException();
        });

    console.log(userDelegationKey);

    return { startTime, expirationTime, userDelegationKey };
  }

Error itself:

TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received undefined at Function.from (node:buffer:322:9) at new UserDelegationKeyCredential (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/credentials/UserDelegationKeyCredential.ts:37:23) at generateBlobSASQueryParametersInternal (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/sas/BlobSASSignatureValues.ts:341:35) at generateBlobSASQueryParameters (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/sas/BlobSASSignatureValues.ts:320:10) at BlobStorageService.getSaSToken (/media/vasile/tt/tech-titans/chat-backend/src/core/blob-storage/blob.storage.service.ts:124:52)

Nandamuri Pranay Teja 4,855 Microsoft External Staff Moderator

Hello Vasile

Thank you for posting the question!

Based on the error and the fact that you're using the Node.js SDK (@azure/storage-blob), the issue is likely related to the UserDelegationKeyCredential constructor expecting certain properties from the user delegation key response that might be undefined or have changed format.

To investigate further could you please provide me the below details:

What are the exact versions of all Azure packages you're using? Can you log the userDelegationKey right after retrieving it to see if it’s returning as expected? Have you checked the release notes for breaking changes that could affect your implementation? Are you receiving this error in any specific environment (e.g., local, staging, production)?

How ever in the meantime you can Add more detailed logging to see what's in the userDelegationKey object:

private async getUserDelegationKey(liveDuration: number): Promise<{
  startTime: Date;
  expirationTime: Date;
  userDelegationKey: ServiceGetUserDelegationKeyResponse;
}> {
  const NOW = new Date();
  const startTime = new Date(NOW.valueOf() - this.TEN_MINUTES);
  const expirationTime = new Date(NOW.valueOf() + liveDuration);
  const userDelegationKey: ServiceGetUserDelegationKeyResponse =
    await this.blobServiceClient
      .getUserDelegationKey(startTime, expirationTime)
      .catch((error) => {
        this.logger.error(error, error.stack);
        throw new InternalServerErrorException();
      });
  // Add detailed logging to see what properties are available
  console.log('User delegation key response:', JSON.stringify(userDelegationKey, null, 2));
  console.log('signedObjectId:', userDelegationKey.signedObjectId);
  console.log('signedTenantId:', userDelegationKey.signedTenantId);
  console.log('signedService:', userDelegationKey.signedService);
  console.log('signedVersion:', userDelegationKey.signedVersion);
  console.log('value:', userDelegationKey.value);
  return { startTime, expirationTime, userDelegationKey };
}

Validate the user delegation key before using it:

async getSaSToken(blobName: string): Promise<string> {
  const { startTime, expirationTime, userDelegationKey } =
    await this.getUserDelegationKey(this.THIRTY_MINUTES);
  // Validate required properties
  if (!userDelegationKey.value || !userDelegationKey.signedObjectId || 
      !userDelegationKey.signedTenantId || !userDelegationKey.signedService ||
      !userDelegationKey.signedVersion) {
    this.logger.error('Invalid user delegation key response', userDelegationKey);
    throw new InternalServerErrorException('Invalid user delegation key');
  }
  const sasOptions: BlobSASSignatureValues = {
    blobName,
    containerName: BlobContainerNamesEnum.UPLOADS,
    permissions: BlobSASPermissions.parse('r'),
    protocol: SASProtocol.Https,
    startsOn: startTime,
    expiresOn: expirationTime,
  };
  const sasToken = generateBlobSASQueryParameters(
    sasOptions,
    userDelegationKey,
    this.storageAccountConfig.name,
  ).toString();
  return `${this.blobStorageUrl}/${BlobContainerNamesEnum.UPLOADS}/${blobName}?${sasToken}`;
}

Run the code with the additional logging first to see exactly what's in the userDelegationKey response, and that should reveal which property is undefined and causing the Buffer creation to fail and check your Azure credentials have the necessary permissions to generate user delegation keys. You need the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission.

Post which try using account key authentication temporarily to isolate if this is a user delegation key specific issue.

Run the code with the additional logging first to see exactly what's in the userDelegationKey response, and that should reveal which property is undefined and causing the Buffer creation to fail.

Let me know if you have any questions or concerns via comment.

Vasile 20

Hey @Nandamuri Pranay Teja ,

User delegation key response:

 {
  "_response": {
    "status": 403,
    "headers": {
      "_headersMap": {
        "content-length": {
          "name": "content-length",
          "value": "438"
        },
        "content-type": {
          "name": "content-type",
          "value": "application/xml"
        },
        "server": {
          "name": "server",
          "value": "Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0"
        },
        "x-ms-request-id": {
          "name": "x-ms-request-id",
          "value": "f33c931c-601e-0016-325a-133201000000"
        },
        "date": {
          "name": "date",
          "value": "Fri, 22 Aug 2025 11:50:25 GMT"
        }
      }
    },
    "request": {
      "url": "https://${name of storage account}.blob.core.windows.net/?restype=service&comp=userdelegationkey",
      "method": "POST",
      "headers": {
        "_headersMap": {
          "content-type": {
            "name": "Content-Type",
            "value": "application/xml; charset=utf-8"
          },
          "user-agent": {
            "name": "User-Agent",
            "value": "azsdk-js-azure-storage-blob/12.28.0 core-rest-pipeline/1.22.0 Node/22.11.0 OS/(x64-Linux-6.14.0-28-generic)"
          },
          "x-ms-client-request-id": {
            "name": "x-ms-client-request-id",
            "value": "21f6daaa-ed1d-4507-910f-63d8795f817c"
          },
          "authorization": {
            "name": "Authorization",
            "value": "Bearer ${here is bearer token}"
          }
        }
      },
      "withCredentials": false,
      "timeout": 0,
      "requestId": "21f6daaa-ed1d-4507-910f-63d8795f817c",
      "keepAlive": false,
      "streamResponseStatusCodes": {}
    },
    "bodyAsText": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.\nRequestId:f33c931c-601e-0016-325a-133201000000\nTime:2025-08-22T11:50:26.0927683Z</Message><AuthenticationErrorDetail>Authentication scheme Bearer is not supported in this version.</AuthenticationErrorDetail></Error>",
    "parsedBody": {
      "Code": "AuthenticationFailed",
      "Message": "Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.\nRequestId:f33c931c-601e-0016-325a-133201000000\nTime:2025-08-22T11:50:26.0927683Z",
      "AuthenticationErrorDetail": "Authentication scheme Bearer is not supported in this version."
    }
  },
  "signedStartsOn": null,
  "signedExpiresOn": null
}

signedObjectId: undefined
signedTenantId: undefined
signedService: undefined
signedVersion: undefined
value: undefined

This is strange why do i get 403 error code after sdk update

Nandamuri Pranay Teja 4,855 Microsoft External Staff Moderator

Hello Vasile

So, the new SDK version 12.28.0 likely defaults to using the 2025-07-05 service version, which may have authentication requirements. You can explicitly set an older service version that works with Bearer tokens:

import { BlobServiceClient } from '@azure/storage-blob';
import { DefaultAzureCredential } from '@azure/identity';
// Create the BlobServiceClient with an explicit older service version
const credential = new DefaultAzureCredential();
const blobServiceClient = new BlobServiceClient(
  `https://${this.storageAccountConfig.name}.blob.core.windows.net`,
  credential,
  {
    // Explicitly use an older service version that supports Bearer tokens
    apiVersion: '2023-11-03' // or '2024-05-04'
  }
);

If you need to use the latest service version, you might need to adjust how you're authenticating. Make sure you're using the latest authentication patterns:

import { DefaultAzureCredential } from '@azure/identity';
import { BlobServiceClient } from '@azure/storage-blob';
// Ensure you're using the correct credential chain
const credential = new DefaultAzureCredential({
  // Add any specific credential options if needed
  managedIdentityClientId: process.env.AZURE_CLIENT_ID, // if using managed identity
});
const blobServiceClient = new BlobServiceClient(
  `https://${this.storageAccountConfig.name}.blob.core.windows.net`,
  credential
);

also Make sure your Azure AD application has the correct permissions and API permissions:

Required Azure AD App Permissions: https://storage.azure.com/user_impersonation (for user delegation) Required RBAC Roles on the Storage Account: Storage Blob Data Reader (minimum) Storage Blob Delegator (required for user delegation keys).

Let me know if you have any questions or concerns via comment.

Vasile 20 Reputation points

2025-08-25T08:56:16.07+00:00

Thank for your help, i appreciate it @Sina Salam and @Nandamuri Pranay Teja but the problem was not in permissions.I found solution on github here .PS:If someone is lazy to read github issue fix is in deleting yarn.lock file and node_modules folder!
Sina Salam 24,096 Reputation points Volunteer Moderator

2025-08-25T13:42:03.79+00:00

Hi Vasile,

Thanks for your response and sharing that the issue was resolved. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution kindly "Accept " the answer to show up at the top, and thump up to resulting in improved discoverability for others in the community have the same issues.

Thank you.

1 answer

Your answer

Nandamuri Pranay Teja 4,855 Reputation points Microsoft External Staff Moderator

2025-08-22T16:02:45.2033333+00:00

Hello Vasile

So, the new SDK version 12.28.0 likely defaults to using the 2025-07-05 service version, which may have authentication requirements. You can explicitly set an older service version that works with Bearer tokens:

import { BlobServiceClient } from '@azure/storage-blob'; import { DefaultAzureCredential } from '@azure/identity'; // Create the BlobServiceClient with an explicit older service version const credential = new DefaultAzureCredential(); const blobServiceClient = new BlobServiceClient( `https://${this.storageAccountConfig.name}.blob.core.windows.net`, credential, { // Explicitly use an older service version that supports Bearer tokens apiVersion: '2023-11-03' // or '2024-05-04' } );

If you need to use the latest service version, you might need to adjust how you're authenticating. Make sure you're using the latest authentication patterns:

import { DefaultAzureCredential } from '@azure/identity'; import { BlobServiceClient } from '@azure/storage-blob'; // Ensure you're using the correct credential chain const credential = new DefaultAzureCredential({ // Add any specific credential options if needed managedIdentityClientId: process.env.AZURE_CLIENT_ID, // if using managed identity }); const blobServiceClient = new BlobServiceClient( `https://${this.storageAccountConfig.name}.blob.core.windows.net`, credential );

also Make sure your Azure AD application has the correct permissions and API permissions:

Required Azure AD App Permissions: https://storage.azure.com/user_impersonation (for user delegation) Required RBAC Roles on the Storage Account: Storage Blob Data Reader (minimum) Storage Blob Delegator (required for user delegation keys).

Let me know if you have any questions or concerns via comment.
Vasile 20 Reputation points

2025-08-25T08:56:16.07+00:00

Thank for your help, i appreciate it @Sina Salam and @Nandamuri Pranay Teja but the problem was not in permissions.I found solution on github here .PS:If someone is lazy to read github issue fix is in deleting yarn.lock file and node_modules folder!
Sina Salam 24,096 Reputation points Volunteer Moderator

2025-08-25T13:42:03.79+00:00

Hi Vasile,

Thanks for your response and sharing that the issue was resolved. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution kindly "Accept " the answer to show up at the top, and thump up to resulting in improved discoverability for others in the community have the same issues.

Thank you.

Answer 1

Sina Salam 24,096 Volunteer Moderator

Hello Vasile,

Issue:

Customer upgrading JS SDK Azure blob storage gives error

Error Message:

TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received undefined at Function.from (node:buffer:322:9) at new UserDelegationKeyCredential (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/credentials/UserDelegationKeyCredential.ts:37:23) at generateBlobSASQueryParametersInternal (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/sas/BlobSASSignatureValues.ts:341:35) at generateBlobSASQueryParameters (/media/vasile/tt/tech-titans/chat-backend/node_modules/@azure/storage-blob/src/sas/BlobSASSignatureValues.ts:320:10) at BlobStorageService.getSaSToken (/media/vasile/tt/tech-titans/chat-backend/src/core/blob-storage/blob.storage.service.ts:124:52)

Solution:

Customer confirmed the problem was not in permissions and found the solution on github here

PS: The github issue fix is in deleting yarn.lock file and node_modules folder!

Sina Salam 24,096 Reputation points Volunteer Moderator

2025-08-22T13:23:30.7266667+00:00
Hello Vasile,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are getting the error TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string... Received undefined when generating a SAS token with @azure/storage-blob after upgrading from v12.27.0 to v12.28.0.

Beyond mere diagnostic to complete treatment. If you inspect the stack trace closely, the failure happens in UserDelegationKeyCredential, which calls Buffer.from(userDelegationKey.value). This indicates that the value property of your user delegation key is undefined.

According to Microsoft’s documentation, the return of getUserDelegationKey() already contains the proper fields and should be passed directly to generateBlobSASQueryParameters along with the correct account name. - Generate SAS with User Delegation Key. For the fact that the problem is related to Azure RBAC and SAS generation, you need to confirm that the calling identity has the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey action at the correct scope (storage account, resource group, or subscription). This action is included in roles like Storage Blob Delegator and Storage Blob Data Owner. You can check this with Azure CLI:

az role assignment list \ --assignee <principalObjectId> \ --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<accountName>

If the role is missing, assign it with:

az role assignment create \ --assignee <principalObjectId> \ --role "Storage Blob Delegator" \ --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<accountName>

For more reading and steps use: Assign an Azure role for access to blob data

Among many things you can do:

Run a diagnostic log of the getUserDelegationKey() response and confirm that the value property is populated before using it. If it prints undefined, the issue is permissions or account mismatch.

Ensure the accountName string passed into generateBlobSASQueryParameters exactly matches the storage account used by your BlobServiceClient.

Keep the key lifetime within the supported 7-day maximum (your 30-minute window is fine).

Pin and reinstall your @azure/storage-blob and @azure/identity versions to avoid version skew in node_modules.

The below is a minimal working example adapted to your scenario:

const { BlobServiceClient, BlobSASPermissions, SASProtocol, generateBlobSASQueryParameters } = require("@azure/storage-blob"); const { DefaultAzureCredential } = require("@azure/identity"); const accountName = process.env.STORAGE_ACCOUNT; const serviceClient = new BlobServiceClient(https://${accountName}.blob.core.windows.net, new DefaultAzureCredential()); async function createReadSas(containerName, blobName) { const startsOn = new Date(Date.now() - 10 * 60 * 1000); const expiresOn = new Date(Date.now() + 30 * 60 * 1000); const userDelegationKey = await serviceClient.getUserDelegationKey(startsOn, expiresOn); if (!userDelegationKey.value) throw new Error("Missing userDelegationKey.value — check RBAC roles and accountName."); const sas = generateBlobSASQueryParameters({ containerName, blobName, permissions: BlobSASPermissions.parse("r"), protocol: SASProtocol.Https, startsOn, expiresOn, }, userDelegationKey, accountName).toString(); return https://${accountName}.blob.core.windows.net/${containerName}/${blobName}?${sas}; }

Documentation and references for further troubleshooting:

https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-create-user-delegation-sas-javascript

https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal

https://learn.microsoft.com/en-us/javascript/api/@azure/storage-blob/blobserviceclient#getUserDelegationKey

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Upgrading JS SDK Azure blob storage gives error

1 answer

Your answer