Edge Security Acceleration:Domain name configuration

Before you begin

Both Custom Domains and Routes require an active site in your account.

An active site is a site that has a purchased plan and is connected using an NS or CNAME record.

Choose the right configuration method

Use domain binding

Use Custom Domains to direct all traffic from a domain name to a specific Functions and Pages service for processing.

The domain binding feature lets you link a Functions and Pages service to your site's domain name. After the domain name is bound, you can use it to directly access the Functions and Pages service. The domain name bound to the Functions and Pages service must belong to an active site. After you configure the binding in the console, ESA automatically adds a DNS record for the bound domain name to the site.

1. Log on to the ESA console. In the navigation pane on the left, choose Edge Computing > Functions and Pages. Click the Functions and Pages service that you want to configure.

2. Click the Domain Names tab. In the Custom Domains section, click Add Domain Name.

3. Enter the domain name that you want to bind to the Functions and Pages service, such as pages.example.com. After the domain name is added, a new DNS record is created for the corresponding site.

   Note

   The new domain name inherits the configurations of its site. If the site does not have an SSL/TLS certificate, the bound domain name cannot be accessed over HTTPS. For more information about how to enable SSL/TLS for a site, see SSL/TLS.

   

4. Follow the steps that correspond to your site's connection type:

   Site connected using NS setup

   If your site is connected using an NS record, wait for the DNS record to take effect. This process takes about one minute. Then, access the newly bound custom domain name, such as pages.example.com, in a browser to view the result.

   Site connected using CNAME setup

   If your site is connected using a CNAME record, you must configure a CNAME record with your DNS provider for the binding to take effect.

   1. Click View DNS Records to the right of the newly added custom domain name.

      

   2. Copy the CNAME value that ESA generated for the new DNS record.

      

   3. Go to your DNS provider and add a CNAME record to your domain name's DNS settings:

      • Host Record: Enter the prefix of the custom domain name. In this example, enter pages.

      • Record Type: Select CNAME.

      • Record Value: Paste the CNAME value that you copied in the previous step.

      

   4. Return to the ESA console. Wait until the CNAME Status changes to Configured.Then, access the newly bound custom domain name, such as pages.example.com, in a browser to view the result.

Use routing configuration

You can use routing to forward requests for specific URL paths to a Functions and Pages service. This method provides fine-grained traffic shaping. If a request matches a configured URL pattern, the Functions and Pages service processes it. Otherwise, the request continues through the ESA accelerated back-to-origin process. For example, if you configure the routing rule example.com/a* for the example.com site, all requests to matching paths, such as /a, /a1, and /a2, are processed by the Functions and Pages service. Requests to non-matching paths, such as /b, /c, and /d, follow the standard back-to-origin or caching process.

1. Log on to the ESA console. In the navigation pane on the left, choose Edge Computing > Functions and Pages. Click the Functions and Pages service that you want to configure.

2. Click the Domain Names tab. In the Routes section, click Add Route.

3. Enter a Routing Name. In the Select Site list, select the target site, for example, example.com.

4. Select a Routing Pattern:

   1. Basic mode: This pattern matches requests based only on the URL, which includes the hostname and path. For example, you can configure all requests with the URL prefix pages.example.com to be routed to a Functions and Pages service:

   2. Custom Pattern: This pattern is suitable for scenarios that require complex logical matching based on multiple conditions, such as request headers, cookies, and request methods. You can add multiple matching conditions and specify the logical relationship between them as either "meet all" or "meet any". For example, you can configure a rule that forwards a request to a Functions and Pages service only if the hostname equals www.example.com and the User-Agent request header contains Mobile:

5. Access a matching routing path in a browser to view the result.

   

Bypass mode

After you enable bypass mode for a routing rule, when a request matches the routing policy, the request is sent to the Functions and Pages service as a sub-request. The overall process of bypass mode is as follows:

1. A client sends a request to an ESA point of presence (POP).

2. The request matches a routing policy and is forwarded to the Functions and Pages service for processing. In the Functions and Pages service, you can perform operations such as logging and authentication based on the request content. Note that when bypass mode is enabled, the request body is not forwarded to the Functions and Pages service.

3. If the response from the Functions and Pages service has a status code of 200, the request proceeds to the next processing step. If the status code is not 200, ESA aborts the request and returns a 403 status code to the client.

4. The request is then matched against subsequent policies and proceeds through the ESA cache matching or accelerated back-to-origin logic.

5. The response from a cache hit or from the origin server is returned to the ESA POP. At this point, the response is no longer processed by the Functions and Pages service.

6. The response is forwarded to the client.

Common scenarios

• Logging: If you want to generate logs for some requests, you can forward the requests to a Functions and Pages service in bypass mode and define custom logging logic in the function.

• Authentication for large file downloads: When an edge function forwards a response to a client, it consumes CPU time. If the response is too large, it can exceed the CPU time slice limit and incur extra costs. You can use bypass mode to perform authentication with a Functions and Pages service to avoid these issues.

FAQ

import { createHash } from "node:crypto";

async function handleRequest(request) {
  const url = new URL(request.url);
  const path = url.pathname;
  const delta = 3600;

  const authKeyTypeA = url.searchParams.get('auth_key');

  const privateKey = 'your_secret_key'
  const currentTimestamp = Math.floor(Date.now() / 1000);

  if (!authKeyTypeA) {
    // Authentication failed. The edge returns a 403 status code to the client by default.
    return new Response('Unauthorized', { 
      status: 401,
    });
  }

  const [timestamp, rand, uid, signature] = authKeyTypeA.split('-');

  if (currentTimestamp > parseInt(timestamp)+ delta) {
    // Authentication failed. The edge returns a 403 status code to the client by default.
    return new Response('Link expired', {
      status: 403,
    });
  }

  const signString = [path, timestamp, rand, uid, privateKey].join('-');

  const md5 = createHash('md5').update(signString).digest('hex');

  if (md5 !== signature) {
  
    return new Response('Unauthorized', {
      status: 401
    });
  }

  // If the resource is on another domain name, send a request and return the response.
  // const yourUrl = `https://your-dcdn-domain.com${path}${url.search}`
  // const cdnResponse = await fetch(yourUrl, request)
  // return new Response(cdnResponse.body, cdnResponse)

  // In most cases, you can just fetch from the origin.
  return fetch(request.url)
}

export default {
  async fetch(request) {
    return handleRequest(request)
  }
}

import { createHash } from "node:crypto";

async function handleRequest(request) {
  const url = new URL(request.url);
  const path = url.pathname;
  const delta = 3600;

  const authKeyTypeA = url.searchParams.get("auth_key");

  const privateKey = "your_secret_key";
  const currentTimestamp = Math.floor(Date.now() / 1000);

  if (!authKeyTypeA) {
    // Authentication failed. Pass false. The edge returns a 403 status code to the client by default.
    return new ResponseBypass(false, {
      status: 401,
    });
  }

  const [timestamp, rand, uid, signature] = authKeyTypeA.split("-");

  if (currentTimestamp > parseInt(timestamp) + delta) {
    // Authentication failed. Pass false. The edge returns a 403 status code to the client by default.
    return new ResponseBypass(false, {
      status: 403,
    });
  }

  const signString = [path, timestamp, rand, uid, privateKey].join("-");

  const md5 = createHash("md5").update(signString).digest("hex");

  if (md5 !== signature) {
    // Authentication failed. Pass false. The edge returns a 403 status code to the client by default.
    return new ResponseBypass(false, {
      status: 401,
    });
  }

  // Authentication succeeded. Pass true. The request continues to the origin, and the response is no longer processed by the function.
  const resSuccess = new ResponseBypass(true);
  return resSuccess;
}

export default {
  async bypass(request) {
    return handleRequest(request);
  },
};