Several Azure Java SDK objects (see BlobSasPermission and BlobServiceSasSignatureValues), are used to generate SAS (Shared Access Signature), which is then used to generate direct access URLs with the configured duration (see Repository and Content Store expiry times configurations).
The pre-signed request generates a download for the remote content.
Known Limitations: SAS generation on Azure Blob depends on the authorization type used (only valid for Azure AD or shared key authorization), see: https://docs.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas
See also the GitHub project documentation for a detailed view of the main flows and other parts of the implementation.