Alibaba Cloud CDN provides the URL signing feature to protect origin servers from unauthorized downloads and access. Alibaba Cloud CDN supports four URL signing types. This topic describes how type B signing works.
How it works
How a URL is signed based on type B signing
http://DomainName/{<timestamp>/<md5hash>}/FileName
NoteThe content that is enclosed in braces (
{}
) indicates the encrypted information that is added to the standard URL.Fields in a signed URL
Field
Description
DomainName
The accelerated domain name.
timestamp
The time when a signed URL is generated. The timestamp and the TTL value determine when a signed URL expires. The time is in UTC+8 and follows the yyyyMMddHHmm format.
NoteIn most cases, the validity period of a signed URL equals the value of the TTL parameter. In some cases, the signing server also assigns a TTL value to a signed URL. Timestamp = UNIX timestamp on the signing server + TTL assigned by the signing server. Validity period of the signed URL = Timestamp + TTL that is configured on Alibaba Cloud CDN.
md5hash
The string that is calculated by using the MD5 algorithm. The string must be 32 characters in length, and can contain digits and lowercase letters.
The
md5hash
value is calculated by using the following method:sstring = "Privatekey+timestamp+URI" (The URI specifies the address that points to the requested resource. The URI does not contain parameters such as /Filename.) md5hash = md5sum(sstring)
Filename
The actual URL that points to the requested resource on the origin server. The value of the Filename field must start with a forward slash (
/
).Authentication logic
When a point of presence (POP) receives a request, the POP determines whether the time that is calculated by adding the
timestamp
and theTTL
values in the request is earlier than the current time.If the time that is calculated by adding the
timestamp
and theTTL
values in the request is earlier than the current time, the POP determines that the URL of the request expired and returns a 403 error.If the time that is calculated by adding the
timestamp
and theTTL
values in the request is later than the current time, ansstring
is generated. Then, anmd5hash
value is generated based on the MD5 algorithm. The generatedmd5hash
value is compared with themd5hash
value in the request.If the values are the same, the request passes the authentication. The POP returns the requested resource.
NoteIf a request passes the authentication, URL signing parameters are removed from the URL to increase the cache hit ratio and reduce back-to-origin traffic.
The format of the URL that is used to generate a cache key is
http://DomainName/FileName
.The format of the URL in the origin request is
http://DomainName/FileName
.
If the two values are different, the request fails the authentication. The POP returns the HTTP 403 status code.
Examples
The following example shows how to implement type B signing.
Sample conditions
Retrieve an object from the origin server:
http://domain.example.com/4/44/44c0909bcfc20a01afaf256ca99a8b8b.mp3
NoteIf the URL of the requested object contains Chinese characters, you need to encode the URL before you concatenate a signed URL.
Original URL:
https://example.com/image/阿里云.jpg
Encoded URL:
https://example.com/image/%E9%98%BF%E9%87%8C%E4%BA%91.jpg
Set auth_key to aliyuncdnexp1234.
Set timestamp to 201508150800.
Concatenation procedure
Generate a signature string that is used to calculate the
md5hash
value.aliyuncdnexp1234201508150800/4/44/44c0909bcfc20a01afaf256ca99a8b8b.mp3
Calculate the
md5hash
value based on the signature string.md5hash = md5sum("aliyuncdnexp1234201508150800/4/44/44c0909bcfc20a01afaf256ca99a8b8b.mp3") = 9044548ef1527deadafa49a890a377f0
Generate a signed URL.
http://domain.example.com/201508150800/9044548ef1527deadafa49a890a377f0/4/44/44c0909bcfc20a01afaf256ca99a8b8b.mp3
If a client uses a signed URL to request a resource, the POP compares the calculated md5hash
value with the md5hash
value in the request. If they are the same, such as 9044548ef1527deadafa49a890a377f0, and the signed URL is within the validity period, the request passes the authentication. Otherwise, the authentication fails.