LibreChat adds secure, refreshable Azure Blob SAS URLs for private storage

Organizations using LibreChat with Azure Blob can now keep containers private in production without exposing permanent public links or adding a reverse proxy just to protect files, while still serving uploads/avatars through short-lived links that are automatically refreshed. This matters to operators and users because it closes a silent security gap where missing env config created world-readable containers and reduced 401 incidents after file uploads switched to private access. The implementation now aligns Azure behavior with existing S3 logic and uses stricter error handling for bad connection strings, so the next signals to watch are whether any legacy deployments break on the new default and whether link refresh timing causes spikes in re-auth traffic or residual 401s.

Organizations using LibreChat with Azure Blob can now keep containers private in production without exposing permanent public links or adding a reverse proxy just to protect files, while still serving uploads/avatars through short-lived links that are automatically refreshed. This matters to operators and users because it closes a silent security gap where missing env config created world-readable containers and reduced 401 incidents after file uploads switched to private access. The implementation now aligns Azure behavior with existing S3 logic and uses stricter error handling for bad connection strings, so the next signals to watch are whether any legacy deployments break on the new default and whether link refresh timing causes spikes in re-auth traffic or residual 401s.