CDN:Type C signing

How it works

• Structure of a signed URL for type C signing

  • Format 1

    http://DomainName/{<md5hash>/<timestamp>}/FileName

  • Format 2

    http://DomainName/FileName?{KEY1=<md5hash>&KEY2=<timestamp>}

  Note

  The content in {} is the encrypted information that is added to the standard URL.

• Field description

  Field	Description
  DomainName	The domain name of your CDN site.
  PrivateKey	A custom encryption key. It must be 16 to 32 characters long and can contain uppercase letters, lowercase letters, and digits.
  FileName	The URL for the actual origin fetch. For signing, the FileName must start with /.
  timestamp	The time when the signing server generates the signed URL. This field, along with the validity period of the signed URL, determines when the signed URL expires. The time is a Unix timestamp from the signing server. A Unix timestamp is the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970. It is a 10-digit positive decimal integer and is independent of the time zone. The timestamp is represented in hexadecimal format. Note In most cases, the validity period of the signed URL is the validity period configured for CDN. If you extend the validity period when you generate the signed URL, `timestamp` = UNIX timestamp + extended period. The actual validity period of the signed URL is `timestamp` + the period configured for CDN.
  md5hash	A string calculated using the MD5 algorithm. It is a 32-character fixed-length string that consists of digits 0-9 and lowercase letters a-z. The value of md5hash is calculated from the following string. sstring = "Privatekey+URI+timestamp" (URI is the relative address of the requested object and does not contain parameters, such as /Filename) md5hash = md5sum(sstring)

• Authentication logic

  After a CDN server receives a request for a resource, it checks whether timestamp + validity period of the signed URL is earlier than the current time.

  • If timestamp + validity period of the signed URL is earlier than the current time, the server determines that the URL has expired and returns an HTTP 403 error.

  • If timestamp + validity period of the signed URL is not earlier than the current time, the server constructs a string in the sstring format. For information about how to construct the sstring, see the table. The server then uses the MD5 algorithm to calculate the md5hash value. Finally, the server compares the calculated md5hash value with the md5hash value in the user's request.

    • If the values match, the authentication is successful and the resource is returned.

      Note

      When authentication is successful, the signing parameters are removed from the URL to revert it to the original URL. This improves the cache hit ratio and reduces back-to-origin traffic. For example:

      • URL format with signing parameters: http://DomainName/FileName?{KEY1=<md5hash>&KEY2=<timestamp>}

      • After authentication succeeds:

        • URL format used to generate the cache key: http://DomainName/FileName

        • URL format for the actual origin fetch: http://DomainName/FileName

    • If the values do not match, the authentication fails and an HTTP 403 error is returned.