URL signing examples - CDN - Alibaba Cloud Documentation Center

Use these Python examples to implement server-side URL signing for Alibaba Cloud CDN URL authentication. Each signing type produces a different signed URL format — choose the one that matches your CDN URL authentication configuration.

Choose a signing type

Signing type	Signed URL format	When to use
Type A	`http://example.com/path?auth_key=<exp>-<rand>-<uid>-<hash>`	Appends the auth key as a query parameter. Use when your URLs already carry query strings.
Type B	`http://example.com/<YYYYmmddHHMM>/<hash>/path`	Embeds the timestamp and hash in the path. Use when you want a clean query string.
Type C	`http://example.com/<hash>/<hexexp>/path`	Embeds the hash and hexadecimal expiration in the path. Use for compact, path-based authentication.

For the algorithm details of each signing type, see Type A signing, Type B signing, and Type C signing.

These examples generate signed URLs on your signing server. After generating signed URLs, configure URL authentication in the Alibaba Cloud CDN console to validate them. See What's next.

Parameters

Parameter	Description	Default	Example
`uri`	The original URL to sign	—	`http://example.aliyundoc.com/ping?foo=bar`
`key`	The private key configured in your CDN URL authentication settings	—	`<your-private-key>`
`exp`	The expiration time as a UNIX timestamp. Set to current time plus the desired TTL.	—	`int(time.time()) + 1 * 3600`
`rand`	A random string included in the signed string for Type A signing.	`"0"`	`"0"`
`uid`	A user identifier included in the signed string for Type A signing.	`"0"`	`"0"`

Usage notes

Both Python 2 and Python 3 samples are provided because Python 3 is not backward compatible with Python 2.
Python 2 uses ASCII encoding. Python 3 uses UTF-8 encoding. The Python 3 samples pass encoding='utf-8' to hashlib.md5() to ensure correct hash computation.
If a URL contains Chinese characters, apply URL encoding with UrlEncode() before running the signing code.
The TTL assigned by your signing server and the TTL assigned by Alibaba Cloud CDN are independent. The effective validity period of a signed URL is: UNIX timestamp (signing server) + TTL (signing server) + TTL (Alibaba Cloud CDN). Example: UNIX timestamp 1444435200 + signing server TTL 3600 + CDN TTL 1800 = validity period ends at 1444440600.

Type A signing

Type A signing appends auth_key as a query parameter. The signed string is: <path>-<exp>-<rand>-<uid>-<key>.

Signed URL format:

http://example.aliyundoc.com/ping?foo=bar&auth_key=<exp>-<rand>-<uid>-<hash>

Python 3

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src.encode(encoding='utf-8'))  # UTF-8 encoding required for Python 3
    return m.hexdigest()

def a_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    rand = "0"      # "0" by default, other value is ok
    uid = "0"       # "0" by default, other value is ok
    sstring = "%s-%s-%s-%s-%s" %(path, exp, rand, uid, key)
    hashvalue = md5sum(sstring)
    auth_key = "%s-%s-%s-%s" %(exp, rand, uid, hashvalue)
    if args:
        return "%s%s%s%s&auth_key=%s" %(scheme, host, path, args, auth_key)
    else:
        return "%s%s%s%s?auth_key=%s" %(scheme, host, path, args, auth_key)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    # "1 * 3600" is the TTL assigned by the signing server. Adjust based on your requirements. Unit: seconds.
    # The signing server TTL is independent of the Alibaba Cloud CDN TTL.
    # Validity period = UNIX timestamp (signing server) + TTL (signing server) + TTL (Alibaba Cloud CDN).
    # Example: timestamp 1444435200 + signing server TTL 3600 + CDN TTL 1800 = 1444440600.
    authuri = a_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

Python 2

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src)
    return m.hexdigest()

def a_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    rand = "0"      # "0" by default, other value is ok
    uid = "0"       # "0" by default, other value is ok
    sstring = "%s-%s-%s-%s-%s" %(path, exp, rand, uid, key)
    hashvalue = md5sum(sstring)
    auth_key = "%s-%s-%s-%s" %(exp, rand, uid, hashvalue)
    if args:
        return "%s%s%s%s&auth_key=%s" %(scheme, host, path, args, auth_key)
    else:
        return "%s%s%s%s?auth_key=%s" %(scheme, host, path, args, auth_key)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    authuri = a_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

Type B signing

Type B signing converts the expiration time to YYYYmmddHHMM format using strftime('%Y%m%d%H%M'), then embeds the timestamp and hash in the URL path. The signed string is: key + nexp + path.

Signed URL format:

http://example.aliyundoc.com/<YYYYmmddHHMM>/<hash>/ping?foo=bar

Python 3

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src.encode(encoding='utf-8'))  # UTF-8 encoding required for Python 3
    return m.hexdigest()

def b_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    nexp = datetime.datetime.fromtimestamp(exp).strftime('%Y%m%d%H%M')
    sstring = key + nexp + path
    hashvalue = md5sum(sstring)
    return "%s%s/%s/%s%s%s" %(scheme, host, nexp, hashvalue, path, args)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    authuri = b_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

Python 2

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src)
    return m.hexdigest()

def b_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    nexp = datetime.datetime.fromtimestamp(exp).strftime('%Y%m%d%H%M')
    sstring = key + nexp + path
    hashvalue = md5sum(sstring)
    return "%s%s/%s/%s%s%s" %(scheme, host, nexp, hashvalue, path, args)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    authuri = b_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

Type C signing

Type C signing converts the expiration time to hexadecimal using "%x" % exp, then embeds the hash and hex expiration in the URL path. The signed string is: key + path + hexexp.

Signed URL format:

http://example.aliyundoc.com/<hash>/<hexexp>/ping?foo=bar

Python 3

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src.encode(encoding='utf-8'))  # UTF-8 encoding required for Python 3
    return m.hexdigest()

def c_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    hexexp = "%x" %exp
    sstring = key + path + hexexp
    hashvalue = md5sum(sstring)
    return "%s%s/%s/%s%s%s" %(scheme, host, hashvalue, hexexp, path, args)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    authuri = c_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

Python 2

import re
import time
import hashlib
import datetime

def md5sum(src):
    m = hashlib.md5()
    m.update(src)
    return m.hexdigest()

def c_auth(uri, key, exp):
    p = re.compile("^(http://|https://)?([^/?]+)(/[^?]*)?(\\?.*)?$")
    if not p:
        return None
    m = p.match(uri)
    scheme, host, path, args = m.groups()
    if not scheme: scheme = "http://"
    if not path: path = "/"
    if not args: args = ""
    hexexp = "%x" %exp
    sstring = key + path + hexexp
    hashvalue = md5sum(sstring)
    return "%s%s/%s/%s%s%s" %(scheme, host, hashvalue, hexexp, path, args)

def main():
    uri = "http://example.aliyundoc.com/ping?foo=bar"   # original URI
    key = "<input private key>"                          # private key for URL authentication
    exp = int(time.time()) + 1 * 3600                   # expiration time: 1 hour after current time
    authuri = c_auth(uri, key, exp)
    print("URL : %s\nAUTH: %s" %(uri, authuri))

if __name__ == "__main__":
    main()

What's next

After generating signed URLs on your signing server, configure URL authentication in the Alibaba Cloud CDN console to validate them: