Authentication Mechanism

A request URL using authentication method A looks like: http://DomainName/Filename?auth_key=timestamp-rand-uid-md5hash.

For example, http://www.example.com/test/test.mp4?auth_key=timestamp-rand-uid-md5hash, we will take this as an example in this article.

The following table describes the authentication fields.

Field	Description
DomainName	The acceleration domain name.
Filename	The actual URI which indicates the resource path on the origin server. The Filename field starts with a forward slash (/). For example, /test/test.mp4 is the URI of the request URL mentioned previously in this article.
auth_key	The name of the authentication parameter. The default parameter name is auth_key. Or you can use a customized name.
timestamp	1. The time when the client generated the request URL(with authentication tokens), which indicates the point in time when the request is triggered. The timestamp value is a UNIX time in decimal format. 2. The timestamp and the TTL of the authentication URL work together to determine whether a request URL expires. The validity of the request URL = Timestamp + TTL of authentication URL (configured on CDN console).
rand	A random string comprised of 0 to 64 alphanumeric characters (a-zA-Z0-9). For example: 477b3bbcf6711128c7bec.
uid	The user ID. This field is currently not in use. You may just keep the value as 0.
md5hash	A string of 32 characters calculated by using the MD5 algorithm. Calculation formula: md5hash = md5sum(Filename-timestamp-rand-uid-key) 1. The elements in the formula are connected with a hyphen (-), you can also use a customized character。 2. The key is the preset encryption key which is a sharedkey you configured on CDN console. It consists of 6 to 32 alphanumeric characters(a-zA-Z0-9)，for example, ctcdnkey123.

• Verification method

When a CDN server receives a request, the server performs URL authentication based on the following steps:

Check whether the request URL carries the authentication parameters. If the request URL does not carry the authentication parameters, the CDN server determines that the request is invalid and returns the HTTP status code 403.
Verify the timestamp and validity. The CDN server checks whether the current system time is within the time range of [timestamp, timestamp + TTL of authenticaion URL]. If the current system time is not within this range, the CDN server determines that the request has expired and returns the HTTP status code 403.
Verify the md5hash token. If the timestamp is verified as valid in Step 2, then the CDN server calculates an MD5hash value for the request and checks whether the calculated MD5 hash value is equal to the MD5 hash value carried in the request URL. If the two values are the same, the request passes the authentication and the CDN server returns the requested file. If the two values are different, the request fails the authentication and the CDN server returns the HTTP status code 403.

Example

Origin request URL：http://www.example.com/test/test.mp4
In this example, the encryption key is 123, and we assume that the request URL is generated at 2023/11/1 00:00:00, converted to unix time 1698768000
The string to sign will be: /test/test.mp4-1698768000-0-0-123
Md5hash token calculation: md5hash=md5sum(/test/test.mp4-1698768000-0-0-123)=37e38e6af36a27d1870e0dd2bcfbd18c
The request URL with auth_key token: http://www.example.com/test/test.mp4?auth_key=1698768000-0-0-37e38e6af36a27d1870e0dd2bcfbd18c
Verification processes：

Whether contains auth_key query string parameter in the URL, if not, CDN determines it as invalid request and return https staus code 403.
In this example, the TTL of authentication URL is 300s, if the current time matches the time range from 2023/11/1 00:00:00 to 2023/11/1 00:05:00 then process the token comparison, otherwise, return http status code 403.
If the timestamp is verified as valid, compare the md5hash token carried in the request URL and the one calculated by CDN server, if match, return requested file, otherwise, return http status code 403.

Additional Considerations

After you enable URL authentication method A, the request URL and origin request URL contains the query string parameter auth_key or your customized parameter, you may configure ignore query string while caching or request to origin.

Cache keys settings, you may refer to Cache key settings

For example:

Notes: If Ignore all query string switch is on in the Cache expiration settings, you don't need to configure ignore parameters for cache key. Please refer to Cache TTL settings.

Remove query string parameter auth_key or your customized parameter in the origin request, you may refer to Query string overriding

For example,

Content Delivery Network

Authenticaion method A