Introduction
The URL Signing option of CDN Static, CDN Static Push, and CDN HTTP Live services allows you to protect your CDN content from unwanted downloads.
Token authentication
URL Signing is a token authentication. Only requests with a valid token (also referred as signature, secure or hash) are allowed to access your content. Moreover the token can contain more information such as:
- expiration time
- allowed IP addresses
An example of CDN URL with token
https://cdn.mycompany.com/photo.jpeg?secure=DMF1ucDxtHCxwYQ&expires=2524647600
As you can see in the above example the token is added to the URL as a value of a query string parameter ?secure=.
Token expiration time use case
Tokens can include an expiration timestamp to secure sensitive content. This is particularly useful when providing a CDN URL to a customer that should not be shared publicly, for example, when a user has purchased access to premium content.
By generating a CDN URL with a short-lived token (valid for only a few minutes), you ensure that:
- The customer can initiate the download immediately.
- The link becomes invalid shortly thereafter, preventing unauthorized redistribution or public access if the URL is shared.
Note: The token is validated only when a connection is initiated. An active download will not be interrupted if the token expires while the data transfer is already in progress. However, modern streaming protocols such as HLS and DASH divide a stream into many small segments. After the token expires, the player will no longer be able to download new segments, and playback will eventually stop.
How to enable URL Signing
URL Signing can be enabled during a CDN service creation (in advanced settings) or on the Services/Settings page.
Select Enabled from the URL Signing select box and fill in (any) URL Signing Key.
URL Signing and HLS streaming
Suppose you want to protect the following CDN HLS stream https://cdn.mycompany.com/mystream.m3u8.
Please note that the token generator requires path parameter and thus you can not use "normal" URL Signing because viewer's device will request URLs containing dynamic paths such as the following.
https://cdn.mycompany.com/mystream-1.ts https://cdn.mycompany.com/mystream-2.ts https://cdn.mycompany.com/mystream-3.ts
To solve this problem we provide the following URL Signing feature tailored for protecting HLS streams.
Example
Suppose you want to protect the following CDN HLS stream https://cdn.mycompany.com/mystream.m3u8.
All you need to do is to generate a token for the path / (the root path) and then instead of using the token as a query string parameter (as with "normal" URL Signing) use it as a part of the CDN HLS URL path, e.g.
https://cdn.mycompany.com/secure=DMF1ucDAx1&expires=2524647600&ip=1.2.3.4/mystream.m3u8
Example - protecting separate streams
Suppose you want to protect the following CDN HLS streams separately.
https://cdn.mycompany.com/customer1/mystream.m3u8 https://cdn.mycompany.com/customer2/mystream.m3u8 https://cdn.mycompany.com/customer3/mystream.m3u8
To protect each customer’s stream separately, generate a token for each customer-specific path: /customer1/, /customer2/, and /customer3/. Then include the corresponding token in the CDN HLS URL path:
https://cdn.mycompany.com/secure=DMF1ucDAx1&expires=2524647600/customer1/mystream.m3u8
https://cdn.mycompany.com/secure=VBndjdmdkd&expires=2524647600/customer2/mystream.m3u8
https://cdn.mycompany.com/secure=IPmdk33nnN&expires=2524647600/customer3/mystream.m3u8
Token generated for the path /customer1/ grants access to the stream /customer1/mystream.m3u8 (and also /customer1/my-other-stream.m3u8, etc.) but does not grant access to the other streams /customer2/mystream.m3u8 and /customer3/mystream.m3u8.
How to generate token
To generate a token you can make use of our token generators below. Please note that anyone is welcome to contribute on our GitHub.
Python
Download our Python URL Signing function from the GitHub and follow instructions from the README.md file.
PHP
Download our PHP URL Signing function from the GitHub and follow instructions from the README.md file.
Node.js
Download our Node.js URL Signing function from the GitHub and follow instructions from the README.md file.
Go (Golang)
Download our Go (Golang) URL Signing function from the GitHub and follow instructions from the README.md file.
Rust
Download our Rust URL Signing function from the GitHub and follow instructions from the README.md file.
Java
Download our Java URL Signing function from the GitHub and follow instructions from the README.md file.
.NET
Download our .NET URL Signing function from the GitHub and follow instructions from the README.md file.
Ruby
Download our Ruby URL Signing function from the GitHub and follow instructions from the README.md file.
Bash
Download our Bash URL Signing function from the GitHub and follow instructions from the README.md file.
What next?
Read about the following topics.