CDN:Type A signing

How it works

• Structure of a type A signed URL

  http://DomainName/Filename?auth_key={<timestamp>-rand-uid-<md5hash>}

  Note

  The content in {} represents the encrypted information added to the standard URL.

• Field descriptions

  Field	Description
  DomainName	The domain name of your CDN site.
  Filename	The URL for the actual origin fetch. The Filename must start with a forward slash (/).
  auth_key	The authentication information for the request. It consists of timestamp, rand, uid, and md5hash.
  timestamp	The time when the signing server generates the signed URL. This value, along with the validity period, controls when the signed URL expires. The time is a 10-digit UNIX timestamp, which is the number of seconds that have elapsed since 00:00:00 on January 1, 1970. Note In most cases, the validity period of the signed URL is the validity period configured for CDN. If you extend the validity period when you generate the signed URL, `timestamp` = UNIX timestamp + extended period. The actual validity period of the signed URL is `timestamp` + the period configured for CDN.
  rand	A random number. Use a universally unique identifier (UUID) without hyphens (-). For example: 477b3bbc253f467b8def6711128c7bec.
  uid	User ID. This field is not used. Set it to 0.
  md5hash	A 32-character string calculated using the MD5 algorithm. It consists of digits and lowercase letters. Calculation method: sstring = "URI-Timestamp-rand-uid-PrivateKey" (URI is the relative path of the requested object, such as /Filename, and does not include parameters.) md5hash = md5sum(sstring)

• Authentication logic

  After a CDN server receives a request to access a resource, it checks whether timestamp + validity period is earlier than the current time.

  • If timestamp + validity period is earlier than the current time, the server determines that the URL has expired and returns an HTTP 403 error.

  • If timestamp + validity period is later than the current time, the server constructs a string in the sstring format (see the sstring format in the table). Then, it calculates the md5hash value using the MD5 algorithm and compares the calculated md5hash value with the md5hash value in the user's request.

    • If the values match, authentication is successful and the resource is returned.

      Note

      When authentication is successful, the signing parameters are removed from the URL to revert it to the original URL. This increases the cache hit ratio and reduces back-to-origin traffic. For example:

      • URL with signing parameters: http://DomainName/Filename?auth_key={<timestamp>-rand-uid-<md5hash>}

      • After successful authentication:

        • URL format used to generate the cache key: http://DomainName/FileName

        • URL format for the actual origin fetch: http://DomainName/FileName

    • If the values do not match, authentication fails and an HTTP 403 error is returned.