This topic summarizes frequently asked questions about configuring access control features such as IP blacklists and whitelists, Referer-based hotlink protection, URL signing, and remote authentication. For troubleshooting issues such as HTTP 403 responses or abnormal traffic, see the access control troubleshooting guide.
IP blacklist and whitelist, and origin protection
When configuring an IP blacklist or whitelist, does an IP address range count as one IP address entry or multiple?
CDN When you configure an IP blacklist or whitelist, you can configure up to approximately 700 IPv6 addresses or address ranges and 2,000 IPv4 addresses or address ranges.
One IP address range counts as one IP address entry.
I need to add CDN to the whitelist on my origin server. Can I get the IP addresses of the nodes that Alibaba Cloud CDN uses to access my origin?
If your daily peak bandwidth is 1 Gbps or above, Submit a ticketto apply for permission to call the DescribeL2VipsByDomain API operation, which returns the IP addresses of L2 nodes for the specified domain name (that is, the list of origin fetch IP addresses).
If you do not meet the requirement, we recommend that you migrate to ESA and use the Origin Protection feature, which allows you to obtain the list of origin fetch node IP addresses in the console.
Why can an IP address in the blacklist still access my resources?
CDN acts as the server side and cannot control connections initiated by clients. After you configure an IP blacklist, requests from the blacklisted IP address return error code 403 when they reach CDN nodes, and CDN logs still record these requests. For more information about how to view logs, see Download logs.
Note: When HTTP 403 is returned, no actual resource content flows out — only response headers are transferred — but a small amount of traffic fees are still incurred. The delay of regular logs is usually within 24 hours. If you need to analyze blacklist blocking in a timely manner, we recommend that you enable the real-time log feature, which pushes the collected logs to Log Service in real time for analysis.
How do I get the real IP address of a client?
After you use CDN, you can obtain the real IP address of a client from the X-Forwarded-For field. For more information, see Retrieve the originating IP addresses of clients.
URL signing and remote authentication
Can I enable URL signing and remote authentication of Alibaba Cloud CDN at the same time?
Yes. URL signing and remote authentication of Alibaba Cloud CDN can be enabled at the same time. Requests pass through URL signing first, and then pass through remote authentication.
Does remote authentication support configuring the authentication server as an internal address?
No. The remote authentication server must be configured as a public address.
If the status code returned by the authentication server is neither a success code nor a failure code, why does CDN allow the request by default?
To prevent abnormal situations from blocking all user requests, if the status code returned by the authentication server is neither a success code nor a failure code, the CDN node allows the user request by default (for example, if the success code for authentication is set to 200 and the authentication server returns 201, the request is allowed).
You can configure the Allow Other Status Codes parameter in the console to choose whether to allow other status codes returned by the authentication server.
Does CDN allow all requests directly when the remote authentication server fails or goes down?
No. When the remote authentication server fails or goes down, after the data exchange between CDN and the authentication server times out, CDN decides whether to allow the user requests that timed out during authentication based on the configured Action After Timeout parameter.