All Products
Search

This Product

    CDN:Type F signing

    Document Center

    CDN:Type F signing

    Last Updated:Jun 22, 2026

    URL signing protects your origin server resources from unauthorized access. Alibaba Cloud CDN provides four URL signing methods. Type F uses MD5 hashing with a private key and default parameter names for straightforward authentication.

    Note

    Type F uses MD5 with a private key and the default parameter names sign and time. It is suitable for most basic authentication scenarios.

    Important

    The signed URL must not contain Chinese characters.

    URL signing does not support URLs that already contain query parameters (?), because signing appends its own query parameters.

    How it works

    • Signed URL format

      A signed URL uses the following format:

      http://DomainName/FileName?{sign=<md5hash>&time=<timestamp>}
      Note

      The content in {} indicates authentication parameters appended to the standard URL.

      The sign and time parameter names are defaults. You can customize the Signature Parameter and Timestamp Parameter in the Configure URL signing console.

    • Parameter

      Description

      DomainName

      The domain name accelerated by CDN.

      PrivateKey

      A custom cryptographic key of 16 to 32 characters, consisting of uppercase letters, lowercase letters, and digits.

      FileName

      The resource path for the back-to-origin request. Must start with a forward slash (/).

      timestamp

      The time when the signing server generates the signed URL. Combined with the validity period, this value determines when the signed URL expires. The time is a UNIX timestamp — the number of seconds elapsed since 00:00:00 UTC on January 1, 1970. It is a 10-digit positive decimal integer, independent of time zones. In the Configure URL signing console, you can set the timestamp format to decimal (UNIX timestamp) or hexadecimal (UNIX timestamp).

      Note

      Configure the TTL in the Configure URL Signing console. The signed URL expires at timestamp + the configured validity period.

      md5hash

      A 32-character string generated by the MD5 algorithm. Contains digits 0–9 and lowercase letters a–z.

      The md5hash value is generated from the following signing string:

      sstring = "Privatekey+URI+timestamp" (where URI is the relative path of the requested object, such as /Filename, and does not include query parameters)
md5hash = md5sum(sstring)

    • Authentication logic

      When a CDN edge node receives a request, it first checks whether timestamp + validity period has elapsed.

      • If timestamp + validity period is earlier than the current time, the request has expired. The server returns an HTTP 403 error.

      • If timestamp + validity period is later than the current time, the server constructs a signing string in the sstring format, calculates its MD5 value, and compares the result with the md5hash value in the request.

        • If the values match, authentication succeeds and the requested resource is returned.

          Note

          After authentication succeeds, the edge node strips the authentication parameters from the URL to improve cache hit ratio and reduce back-to-origin traffic. For example:

          • URL with signing parameters: http://DomainName/FileName?{sign=<md5hash>&time=<timestamp>}

          • After authentication:

            • URL used to generate the cache key: http://DomainName/FileName

            • URL for the back-to-origin request: http://DomainName/FileName

        • If the values do not match, authentication fails and the server returns an HTTP 403 error.

    Example

    The following example demonstrates Type F URL signing.

    • Sample conditions

      • Retrieve an object from the origin server:

        http://domain.example.com/test.flv
        Note

        If the request URL contains non-ASCII characters, you must encode the URL first. Use the encoded URL to construct the hash string. For example:

        • Original URL: https://example.com/image/AlibabaCloud.jpg

        • Encoded URL: https://example.com/image/%E9%98%BF%E9%87%8C%E4%BA%91.jpg

      • Set PrivateKey to aliyuncdnexp1234.

      • Set timestamp to 55CE8100.

    • Process

      1. Construct the signing string sstring in the format Privatekey+URI+timestamp.

        aliyuncdnexp1234/test.flv55CE8100

      2. Calculate the MD5 hash of the signing string:

        md5hash = md5sum(aliyuncdnexp1234/test.flv55CE8100)
        = a37fa50a5fb8f71214b1e7c95ec7a1bd

      3. Append the signing result and timestamp as query parameters to form the signed URL:

        http://domain.example.com/test.flv?sign=a37fa50a5fb8f71214b1e7c95ec7a1bd&time=55CE8100

    When a client requests a resource with a signed URL, authentication succeeds if the md5hash value calculated by the CDN server matches the md5hash value in the request — for example, a37fa50a5fb8f71214b1e7c95ec7a1bd — and the URL has not expired. Otherwise, authentication fails.