Hey @ed-sparkes!

Let's split the answer into parts:

1. imgproxy can be configured to access private Azure Blob Storage containers: https://docs.imgproxy.net/image_sources/azure_blob_storage#set-up-credentials. Thus, you don't need a SAS token.

2. Since the SAS token is a part of a URL, it can be a part of imgproxy's source URL. However, since SAS tokens are short-lived, they'll dramatically reduce the cache hit rate. So I'd highly recommend imgproxy's ABS integration instead.

3. imgproxy's URL signatures not only prevent attackers from accessing random images but also prevent them from using your imgproxy for their purposes by changing the processing options of source URLs. Thus it's always recommended to sign imgproxy's URLs.

4. Generating imgproxy signatures on the frontend doesn't make any sense since doing so requires exposing the key/salt pair.