Set up secure access to content

By default, anyone can access your content.

You can customize access by code word or your own script.

Configure access by codeword

The Tokenized URL setting allows you to make links to content temporary and restrict access to content by IP address.

A token of the form md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200) is added to the links on the site. The token is generated:

from a code word you came up with;
file path on the source;
optional: link validity period in POSIX time format;
optional: authorized IP address.

As a result, the link with the token will be of this form:

https://cdn.example.com/md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)/path/to/file.png.

When a user clicks on a link, CDN servers check the token in the request. If the token matches and the lifetime of the link has not expired, the servers deliver the content. CDN-servers themselves receive content from the source regardless of the presence of a code word.

In the Control Panel, on the top menu, click Products and select CDN.
In the CDN Resources section, open the CDN Resource page → Restrictions tab.
In the Authorization block, select By code word.
Enter a code word of 6 to 32 characters. Latin letters and numbers can be used.
Optional: to not specify the link validity time, check the box Do not limit by time.
Optional: To not restrict access to content to only certain IP addresses, check the Do not consider IP checkbox.
Click Apply. The resource will be in PROCESSING status while the settings are being applied . You cannot apply any other settings at this time. The settings will be applied when the share changes to ACTIVE status.
Configure tokenized link generation on the source server using a script. To see script examples, see the Script Examples for Token Generation subsection.

Examples of a script for generating a secure link

For your information

These are examples of a script to generate a token subject to IP address and link validity time constraints.

PHP script
Python script
OpenSSL script

<?php
$secret = '<code_word>';
$ip = '<ip_address>';
$path = '<file_path>';
$lifetime = <link_lifetime>;
$expires = time() + $lifetime;
$link = "$secret$path$ip$expires";
$md5 = md5($link, true);
$md5 = base64_encode($md5);
$md5 = strtr($md5, '+/', '-_');
$md5 = str_replace('=', '', $md5);
$domain = '<domain>';
$url = "$domain/md5($md5,$expires)$path";
echo $url;
echo "\n";

Specify:

<code_word> - the code word you specified when the code word you specified when setting up access to content by code word;
<ip_address> - The IP address that you allow to receive content;
<file_path> - relative path to the file on the source;
<link_lifetime> - link lifetime in seconds;
<cdn_domain> - domain of the CDN resource with the protocol. You can view the domain of the resource in the control panel: in the top menu, click Products → CDN → CDN Resources → resource string.

import base64
from hashlib import md5
from time import time

secret = "<code_word>"
ip = "<ip_address>"
path = "<file_path>"
lifetime = <link_lifetime>
domain = "<cdn_domain>"

expires = int(time()) + lifetime

token_byte = base64.encodebytes(
    md5(f"{secret}{path}{ip}{expires}".encode("utf-8")).digest()
)
token = (
    token_byte
    .decode("utf-8")
    .replace("\n", "")
    .replace("+", "-")
    .replace("/", "_")
    .replace("=", "")
)
secured_url = f"{domain}/md5({token},{expires}){path}"
print(secured_url)

Specify:

<code_word> - the code word you specified when the code word you specified when setting up access to content by code word;
<ip_address> - The IP address that you allow to receive content;
<file_path> - relative path to the file on the source;
<link_lifetime> - link lifetime in seconds;
<cdn_domain> - domain of the CDN resource with the protocol. You can view the domain of the resource in the control panel: in the top menu, click Products → CDN → CDN Resources → resource string.

SECRET="<code_word>"
IP="<ip_address>"
PATH="<file_path>"
LIFETIME=<link_lifetime>
DOMAIN="<cdn_domain>"

EXPIRES=$(($(date +%s) + LIFETIME))

HASH_STRING="${SECRET}${PATH}${IP}${EXPIRES}"

TOKEN=$(echo -n "$HASH_STRING" | openssl md5 -binary | openssl base64 | tr '+/' '-_' | tr -d '=')

SECURED_URL="${DOMAIN}/md5(${TOKEN},${EXPIRES})${PATH}"

echo "$SECURED_URL"

Specify:

<code_word> - the code word you specified when the code word you specified when setting up access to content by code word;
<ip_address> - The IP address that you allow to receive content;
<file_path> - relative path to the file on the source;
<link_lifetime> - link lifetime in seconds;
<cdn_domain> - domain of the CDN resource with the protocol. You can view the domain of the resource in the control panel: in the top menu, click Products → CDN → CDN Resources → resource string.

Customize access by your own script

You can add your own script to authorize users.

When the user clicks on the link, the decision to access the content is made based on the response from the script.

You need to pass headers in the script:

Host - name of the domain for which the request is intended;
X-Request-URI - URI of the requested resource;
X-Forwarded-For - the actual IP address of the user who is requesting the resource;
X-Remote-Addr. - The IP address of the user who is requesting the resource, or the IP address of the proxy server.

In the Control Panel, on the top menu, click Products and select CDN.
In the CDN Resources section, open the CDN Resource page → Restrictions tab.
In the Authorization block, select By external script.
Provide a link to your script.
Click Apply. The resource will be in PROCESSING status while the settings are being applied . You cannot apply any other settings at this time. The settings will be applied when the share changes to ACTIVE status.