Alibaba Cloud CDN provides the URL signing feature to protect origin servers from unauthorized downloads and access. The URL signing feature supports three signing types. This topic describes how type A signing works.

How it works

  • How a URL is signed based on type A signing 
    http://DomainName/Filename?auth_key=timestamp-rand-uid-md5hash
  • Fields in a signed URL
    FieldDescription
    DomainNameThe accelerated domain name.
    FilenameThe actual URL that points to the requested resource on the origin server. The Filename field must start with a forward slash (/).
    auth_keyThe cryptographic key that you have set.
    timestampThe time when a signed URL is generated. The timestamp and the TTL value specify the time when a signed URL expires. The time is represented by a UNIX timestamp, which indicates the number of seconds that have elapsed since 00:00:00 on January 1, 1970 (UTC). The timestamp is a string that consists of 10 positive decimal integers and is irrelevant to the time zone.
    Note In most cases, the validity period of a signed URL equals the value of the TTL parameter. In some cases, the signing server also assigns a TTL value to a signed URL. Timestamp = UNIX timestamp on the signing server + TTL assigned by the signing server. Validity period of the signed URL = Timestamp + TTL assigned by Alibaba Cloud CDN.
    randA random number. The number must not contain hyphens (-). Example: 477b3bbc253f467b8def6711128c7bec. We recommend that you use a universally unique identifier (UUID).
    uidThe user ID. Set this field to 0.
    md5hashThe string that is calculated by using the MD5 algorithm. It must be 32 characters in length, and can contain digits and lowercase letters.
    The md5hash value is calculated based on the following string: 
    sstring = "URI-Timestamp-rand-uid-PrivateKey" (The URI specifies the address that points to the requested resource. It does not contain parameters such as /Filename.)
md5hash = md5sum(sstring)
  • Authentication logic
    When a CDN edge node receives a request, the CDN edge node determines whether the time calculated by adding the timestamp and the TTL value in the request is earlier than the current time.
    • If the time calculated by adding the timestamp and the TTL value in the request is earlier than the current time, the CDN edge node determines that the URL of the request expires and returns a 403 error.
    • If the time calculated by adding the timestamp and the TTL value in the request is later than the current time, a string is generated based on the sstring described in the preceding table. Then, a md5hash value is generated based on the MD5 algorithm. The generated md5hash value is compared with the md5hash value in the request.
      • If they are the same, the request passes the authentication. The CDN edge node returns the requested resource.
        Note If a request passes the authentication, authentication-specific parameters are removed from the URL to increase the cache hit ratio and reduce back-to-origin traffic.
        • The format of the URL that is used to generate a cache key is http://DomainName/FileName.
        • The format of the URL in the back-to-origin request is http://DomainName/FileName.
      • If they are different, the request fails the authentication. The CDN edge node returns a 403 error.

Examples

The following example shows how to implement type A signing.
  • Sample conditions
    • A user wants to retrieve the following resource from the origin server:
      http://cdn.example.com/video/standard/test.mp4
      Note If the URL of the requested object contains Chinese characters, you must encode the URL before you concatenate a signed URL.
    • The cryptographic key is aliyuncdnexp1234.
    • The time when the signing server generates a signed URL is 08:00:00 (UTC+8) on October 10, 2015, which is converted to the decimal integer 1444435200.
  • Concatenation procedure
    1. Alibaba Cloud CDN generates a signature string that is used to calculate the md5hash value. 
      /video/standard/test.mp4-1444435200-0-0-aliyuncdnexp1234
    2. Alibaba Cloud CDN calculates the md5hash value based on the signature string. 
      md5hash = md5sum("/video/standard/test.mp4-1444435200-0-0-aliyuncdnexp1234") = 23bf85053008f5c0e791667a313e28ce
    3. A signed URL is generated. 
      http://cdn.example.com/video/standard/test.mp4?auth_key=1444435200-0-0-23bf85053008f5c0e791667a313e28ce

If a client uses a signed URL to request a resource, Alibaba Cloud CDN compares the calculated md5hash value with the md5hash value in the request. If they are the same, for example, 23bf85053008f5c0e791667a313e28ce, the request passes the authentication. Otherwise, the request fails the authentication.