Authentication mechanism

• An access URL is signed based on authentication method B as follows: http://DomainName/timestamp/md5hash/FileName.

For example, http://www.example.com/timestamp/md5hash/test/test.mp4?a=123, we will take this as an example in this article.

• The following table describes the authentication fields.

Field	Description
DomainName	The acceleration domain name.
Filename	The actual URI which indicates the resource path on the origin server. The Filename field starts with a forward slash (/). For example, /test/test.mp4 is the URI of the request URL mentioned previously in this article.
timestamp	1. The time when the client generated the request URL(with authentication tokens), which indicates the point in time when the request is triggered. The timestamp value is a UNIX time in decimal format. 2. The timestamp and the TTL of the authentication URL work together to determine whether a request URL expires. The validity of the request URL = Timestamp + TTL of authentication URL (configured on CDN console).
md5hash	A string of 32 characters calculated by using the MD5 algorithm. Calculation formula: md5hash = md5sum(keytimestampFileName) 1. By default, no delimiter is used between MD5 encryption elements. You can specify a custom delimiter. 2. The key is the preset encryption key which is a sharedkey you configured on CDN console. It consists of 6 to 32 alphanumeric characters(a-zA-Z0-9)，for example, ctcdnkey123.

• Verification method

When a CDN server receives a request, the server performs URL authentication based on the following steps:

Verify the timestamp and validity. The CDN server checks whether the current system time is within the time range of [timestamp, timestamp + TTL of authenticaion URL]. If the current system time is not within this range, the CDN server determines that the request has expired and returns the HTTP status code 403.
Verify the md5hash token. If the timestamp is verified as valid in Step 1, then the CDN server calculates an MD5hash value for the request and checks whether the calculated MD5 hash value is equal to the MD5 hash value carried in the request URL. If the two values are the same, the request passes the authentication and the CDN server returns the requested file. If the two values are different, the request fails the authentication and the CDN server returns the HTTP status code 403.

Example

Origin request URL：http://www.example.com/test/test.mp4
In this example, the encryption key is 123, and we assume that the request URL is generated at 2023/11/1 00:00:00, converted to unix time 1698768000
The string to sign will be: 1231698768000/test/test.mp4
Md5hash token calculation: md5hash=md5sum(1231698768000/test/test.mp4)=65d443b388d46e350a8ee4ef58963c50
The request URL with auth_key token: http://www.example.com/1698768000/65d443b388d46e350a8ee4ef58963c50/test/test.mp4
Verification processes：

In this example, the TTL of authentication URL is 300s, if the current time matches the time range from 2023/11/1 00:00:00 to 2023/11/1 00:05:00 then process the token comparison, otherwise, return http status code 403.
If the timestamp is verified as valid, compare the md5hash token carried in the request URL and the one calculated by CDN server, if match, return requested file, otherwise, return http status code 403.

Additional Considerations

After you enable URL authentication method B, the request URI will contain the token and timestamp info, please add corresponding caching and origin request settings to ensure cache hit ratio and things work properly.

Cache settings, to setup cache URI overwrite in Cache key, you may refer to Cache key settings.

Notes: The initial request URL is http://www.example.com/1698768000/65d443b388d46e350a8ee4ef58963c50/test/test.mp4, and the URL after rewirte is http://www.example.com/test/test.mp4

Origin request settings, you may refer to Origin request URI override

Notes: The initial request URL is http://www.example.com/1698768000/65d443b388d46e350a8ee4ef58963c50/test/test.mp4, and the origin request URL will be http://www.example.com/test/test.mp4

Content Delivery Network

Authenticaion method B