Content distributed by DCDN is publicly accessible by default. URL signing validates an encrypted string and timestamp in each request URL to prevent unauthorized access and hotlinking of your origin resources.
How URL signing works
DCDN POPs collaborate with your origin server to validate requests. The process involves three components:
Origin application server: Generates a signed URL based on the signing algorithm and key, then returns it to the client.
Client: Sends the signed URL to a DCDN POP to request the resource.
DCDN POP: Validates the information in the signed URL, such as the cryptographic string and timestamp.
You configure signing rules (algorithm and ) on the origin application server.
For example, a signed URL can be in the format of
http://DomainName/timestamp/md5hash/FileName.When a client requests a page, the origin application server generates a signed URL and includes it in the response (Steps 2 and 3).
The client sends the signed URL to a DCDN POP (Step 4).
The DCDN POP validates the cryptographic string and timestamp in the signed URL.
If authentication fails, the request is denied.
If authentication succeeds, the POP serves the content.
NoteIf a resource is not cached on a DCDN POP, the DCDN POP strips the authentication parameters from the URL to restore the original URL (for example,
http://DomainName/FileName) before generating a cache key or fetching from the origin.After DCDN authenticates your request URL, it encodes special characters in the URL, such as Chinese or other non-ASCII characters.
Configure and enable URL signing
Before you begin, ensure that you have configured signing rules (algorithm and key) on your origin application server.
The URL signing logic configured in DCDN must match the logic on your application server.
-
Log on to the DCDN console.
-
In the left-side navigation pane, click Domain Names.
-
On the Domain Names page, find the domain name that you want to manage and click Configure.
-
In the left-side navigation tree of the domain name, click Access Control.
-
Click the URL Signing tab.
-
Turn on the URL Authentication Setting switch.
-
In the URL Signing dialog box, configure the URL signing parameters.
Parameter
Description
Authentication Type
Select the authentication type that matches your origin server's signed URL format.
NoteIf URL signing fails, a 403 error is returned:
MD5 calculation error
Example:
X-Tengine-Error:denied by req auth: invalid md5hash=de7bfdc915ced05e17380a149bd760beTime-related error
Example:
X-Tengine-Error:denied by req auth: expired timestamp=1439469547
Primary Key
Enter the primary key. Must be 6 to 128 alphanumeric characters.
Secondary Key
Enter the secondary key. Must be 6 to 128 alphanumeric characters. At least one key is required.
Validity period
A signed URL remains valid from
timestamptotimestamp+validity period. Requests outside this window are rejected.-
Unit: seconds
-
Value range: 1 to 31,536,000
-
Default value: 1800 (30 minutes)
-
Example: A signed URL with timestamp 2020-08-15 15:00:00 (UTC+8) and a 1800-second validity period expires at 2020-08-15 15:30:00 (UTC+8).
-
Click OK.
Verify the signed URL
After you enable URL signing, generate a test URL in the DCDN console to verify your signing logic.
-
In the Generate Encrypted URL for Testing section, specify the Original URL and authentication information.
Parameter
Description
Original URL
Enter the original URL. Example:
https://www.aliyun.com.Authentication Type
Select the authentication type you configured in Configure and enable URL signing.
Authentication Key
Enter the Primary Key or Secondary Key from Configure and enable URL signing.
Validity Period
Enter the validity period in seconds. Must match the value in Configure and enable URL signing.
-
Click Generate to get the Authentication URL and Timestamp.
Disable URL signing
If you disable URL signing in DCDN but client requests still include signing parameters, DCDN cannot restore request URLs to their original format. All requests then miss the cache and are forwarded to the origin, causing a sharp increase in origin traffic and costs. To stop using URL signing, disable the feature on both your application server and in the console.
-
In the DCDN console, navigate to the URL Authentication Setting section and turn off the URL signing switch.
-
On your origin server, remove the logic that adds authentication parameters to URLs.