[Bernd Verst (berndverst)]

Summary

• Replace the unshipped AllowedHosts option with independent AllowAllContainersInConfiguredAccount and AdditionalAccountURLs settings.
• Keep reads limited to the configured endpoint and container by default. The boolean permits all primary-account containers with existing identity, key, or SAS authentication. Additional HTTPS account endpoints permit all their containers using the primary token credential, without widening the primary container scope.
• Match scheme, hostname, effective port, and SDK-recognized path-style account paths. Validate and snapshot account configuration, deduplicate equivalent additional endpoints, and verify constructed blob destinations before credential acquisition or HTTP requests. Disable redirects and preserve Storage authorization errors without account or credential fallback.
• Preserve v2-by-default writes and v1/v2 reads. Ignore legacy v2 token query and fragment fields while retaining configured authentication. Uploads stay at the primary endpoint and configured container and emit credential-free tokens.
• Apply the same read policy to native tokens, generic Resolve locations, and client/worker hydration. Keep samples on the default scope and document the options and migration behavior.
• Expand offline real-pipeline coverage for access-scope combinations, authentication modes, endpoint matching, configuration validation and mutation, escaped names, legacy query handling, uploads, redirects, and zero-request/zero-token denials.

Validation

• go test ./payload ./internal/largepayload ./client ./durabletaskscheduler
• go test ./... -run '^$' (compile all packages)

[Copilot]

🟢 Approval recommended

No active review issues remain for the Azure Blob read-boundary documentation and offline test additions.

No open issues 🎉

What changed in this PR

Clarifies Azure Blob payload read boundaries and adds offline coverage for existing behavior without changing runtime logic.

Changes:

• Documents hostname-wide AllowedHosts permissions, identity requirements, and default endpoint/container restrictions.
• Adds real Azure client pipeline tests for v1/v2 reads, allowed destinations, and connection-string authentication.
• Verifies rejected references trigger neither HTTP requests nor token acquisition.

File	Description
payload/​azure_blob.go	Expands AllowedHosts API documentation and security guidance.
payload/​azure_blob_access_test.go	Adds offline tests for read boundaries and authentication behavior.
durabletaskscheduler/​README.md	Explains opt-in native token reads versus restricted generic Resolve locations.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Go’s transparent gzip decompression bypasses the compressed-length check in Azure Blob downloads, allowing responses larger than twice the payload limit to be accepted when their decoded payload is small.

1 open issue

• Disable automatic gzip decompression to enforce the compressed-size limit · New

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Azure Blob read-access scope changes.

1 open issue

• Disable automatic gzip decompression to enforce the compressed-size limit

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Automatic HTTP gzip decompression strips headers needed for the compressed-size check, allowing oversized blobs to bypass the limit and consume unbounded bandwidth and decompression work.

1 open issue

• Disable automatic gzip decompression to enforce the compressed-size limit

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The unchecked type assertion in payload/azure_blob.go:115 can panic whenever an application replaces http.DefaultTransport with a tracing or proxy wrapper.

1 open issue

• Avoid panicking when DefaultTransport is replaced · New

1 resolved since last review

• Disable automatic gzip decompression to enforce the compressed-size limit

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Azure Blob read-scope changes.

No open issues 🎉

1 resolved since last review

• Avoid panicking when DefaultTransport is replaced

_{Review effort: Balanced}

[wangbill (YunchuWang)]

Reviewed the scoped Azure Blob payload implementation at 0f45b23, including the latest private-transport change. The earlier gzip decompression and DefaultTransport assertion findings are addressed, and I found no additional blocking issue in the reviewed changes. Current-head required CI remains a separate merge gate.