At this point of time, the application is not secure. The Web API is exposed to the public and the Blob Storage Container has public access control. Anyone who hits the Service URL will get the JSON Data back, and if you access the Blob Asset URL, you can download it in the browser itself. There are several ways we can secure this application. We have used access token mechanism to secure both the Web API and access the Blob storage URL. We can define the Storage Access Policy for Blob Storage and user to only access URL when the container access level is granted.