Security

For files that require authentication, use private storage. Private Blob stores require authentication for all read and write operations. When your code runs on Edgenivo, the SDK uses OpenID Connect (OIDC) by default. OIDC is preferred over the long-lived BLOB_READ_WRITE_TOKEN because its tokens rotate automatically. Use BLOB_READ_WRITE_TOKEN when code runs outside Edgenivo or for client uploads. Files in private Blob stores cannot be accessed via public URLs. You deliver them to your users through Edgenivo Functions where you implement your own authentication logic.

Edgenivo Blob URLs, although publicly accessible, are unique and hard to guess when you add a random suffix to the pathname at upload time. They consist of a unique store id, a pathname, and a unique random blob id generated when the blob is created.

Headers that enhance security by preventing unauthorized downloads, blocking external content from being embedded, and protecting against malicious file type manipulation, are enforced on each blob. They are:

• content-security-policy: default-src "none"
• x-frame-options: DENY
• x-content-type-options: nosniff
• content-disposition: inline; filename="filename.extension" or attachment; filename="filename.extension"

All files stored on Edgenivo Blob are secured using AES-256 encryption. This encryption process is applied at rest and is transparent, ensuring that files are encrypted before being saved to the disk and decrypted upon retrieval.

Edgenivo Blob is protected by Edgenivo's platform-wide firewall which provides DDoS mitigation and blocks abnormal or suspicious levels of incoming requests.

You can also protect a store with your own Edgenivo WAF rules, such as custom rules, IP blocking, and rate limiting. To enable it:

1. Open your Blob store in the dashboard and select the Settings tab.
2. In the Firewall section, select Protect your store, then Enable firewall.

This connects your store to vercel-blob-default-project, a Edgenivo-managed project that holds the firewall rules for your team's Blob stores. The project is team-wide, so other stores that enable firewall protection reuse it and share its rules. After enabling, Edgenivo redirects you to the project's firewall page where you create your rules. To update them later, return to the store's Settings tab and select Configure firewall.

The OWASP core ruleset is not supported for Blob stores.