---
title: "Configure secure access to content"
sidebar_label: "Configure secure access"
description: "How to configure secure access to content using a codeword or custom script"
sidebar_position: 9
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable} from '@selectel/docux/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# Configure secure access to content

By default, any user can access your content.

You can [configure access by code word](#configure-access-by-code-word) or [your own script](#configure-access-by-own-script).

## Configure access by code word \{#configure-access-by-code-word}

Configuring access by code word (Tokenized URL) allows you to make content links temporary and restrict access to content by IP address.

A token of the following format is added to site links: `md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)`. The token is generated from:

* a code word you have created;
* the file path on the origin;
* optional: the link expiration time in POSIX time format;
* optional: the allowed IP address.

As a result, a link with a token will look like this:

```bash
https://cdn.example.com/md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)/path/to/file.png.
```

When a user follows a link, CDN servers verify the token in the request. If the token is valid and the link has not expired, the servers provide the content. CDN servers receive content from the origin regardless of whether a code word is used.

1. In the [control panel](https://my.selectel.ru/cdn-v3), on the top menu, click **Products** and select **CDN**.

2. In the **CDN Resources** section, open the CDN resource page → **Restrictions**.

3. In the **Authorization** block, select **By code word**.

4. Enter a code word between 6 and 32 characters long. You can use Latin letters and digits.

5. Optional: to avoid specifying a link expiration time, select the **Do not limit by time** checkbox.

6. Optional: to avoid restricting content access to specific IP addresses, select the **Do not check IP** checkbox.

7. Click **Apply**. While settings are being applied, the CDN resource enters the `PROCESSING` status. You cannot apply other settings during this time. Settings take effect when the CDN resource transitions to `ACTIVE`.

8. Configure link generation with a token on the origin server using a script. You can view script examples in the [Script examples for generating a token](#examples-of-link-generating-script) subsection.

### Script examples for generating a secure link \{#examples-of-link-generating-script}

:::info

These are script examples for token generation with IP address and link expiration constraints.

:::

<Tabs queryString="example-of-token-generating-script">
  <TabItem value="php" default>
    <TabItemLabel>
      PHP script
    </TabItemLabel>

    ```php
    <?php
    $secret = '<code_word>';
    $ip = '<ip_address>';
    $path = '<file_path>';
    $lifetime = <link_lifetime>;
    $expires = time() + $lifetime;
    $link = "$secret$path$ip$expires";
    $md5 = md5($link, true);
    $md5 = base64_encode($md5);
    $md5 = strtr($md5, '+/', '-_');
    $md5 = str_replace('=', '', $md5);
    $domain = '<domain>';
    $url = "$domain/md5($md5,$expires)$path";
    echo $url;
    echo "\n";
    ```

    Specify:

    * `<code_word>` — the code word you specified when [configuring access by code word](#configure-access-by-code-word);

    * `<ip_address>` — the IP address you permit to access the content;

    * `<file_path>` — the relative file path or path prefix on the origin. For example, there is a relative file path: `/path/to/file.jpg`. To grant access:

      * to a specific file, specify: `/path/to/file.jpg`;
      * to all files starting with `/path/to/`, including subfolders, specify: `/path/to`;
      * to all files in `/path/` and its subfolders, specify: `/path`;

    * `<link_lifetime>` — the link lifetime in seconds;

    * `<cdn_domain>` — the CDN resource domain, including the protocol. You can view the CDN resource domain in the [control panel](https://my.selectel.ru/cdn-v3/resources): in the top menu, click **Products** → **CDN** → **CDN Resources** → the CDN resource row.
  </TabItem>

  <TabItem value="python">
    <TabItemLabel>
      Python script
    </TabItemLabel>

    ```python
    import base64
    from hashlib import md5
    from time import time

    secret = "<code_word>"
    ip = "<ip_address>"
    path = "<file_path>"
    lifetime = <link_lifetime>
    domain = "<cdn_domain>"

    expires = int(time()) + lifetime

    token_byte = base64.encodebytes(
        md5(f"{secret}{path}{ip}{expires}".encode("utf-8")).digest()
    )
    token = (
        token_byte
        .decode("utf-8")
        .replace("\n", "")
        .replace("+", "-")
        .replace("/", "_")
        .replace("=", "")
    )
    secured_url = f"{domain}/md5({token},{expires}){path}"
    print(secured_url)
    ```

    Specify:

    * `<code_word>` — the code word you specified when [configuring access by code word](#configure-access-by-code-word);

    * `<ip_address>` — the IP address you permit to access the content;

    * `<file_path>` — the relative file path or path prefix on the origin. For example, there is a relative file path: `/path/to/file.jpg`. To grant access:

      * to a specific file, specify: `/path/to/file.jpg`;
      * to all files starting with `/path/to/`, including subfolders, specify: `/path/to`;
      * to all files in `/path/` and its subfolders, specify: `/path`;

    * `<link_lifetime>` — the link lifetime in seconds;

    * `<cdn_domain>` — the CDN resource domain, including the protocol. You can view the CDN resource domain in the [control panel](https://my.selectel.ru/cdn-v3/resources): in the top menu, click **Products** → **CDN** → **CDN Resources** → the CDN resource row.
  </TabItem>

  <TabItem value="openssl">
    <TabItemLabel>
      OpenSSL script
    </TabItemLabel>

    ```bash
    SECRET="<code_word>"
    IP="<ip_address>"
    PATH="<file_path>"
    LIFETIME=<link_lifetime>
    DOMAIN="<cdn_domain>"

    EXPIRES=$(($(date +%s) + LIFETIME))

    HASH_STRING="${SECRET}${PATH}${IP}${EXPIRES}"

    TOKEN=$(echo -n "$HASH_STRING" | openssl md5 -binary | openssl base64 | tr '+/' '-_' | tr -d '=')

    SECURED_URL="${DOMAIN}/md5(${TOKEN},${EXPIRES})${PATH}"

    echo "$SECURED_URL"
    ```

    Specify:

    * `<code_word>` — the code word you specified when [configuring access by code word](#configure-access-by-code-word);

    * `<ip_address>` — the IP address you permit to access the content;

    * `<file_path>` — the relative file path or path prefix on the origin. For example, there is a relative file path: `/path/to/file.jpg`. To grant access:

      * to a specific file, specify: `/path/to/file.jpg`;
      * to all files starting with `/path/to/`, including subfolders, specify: `/path/to`;
      * to all files in `/path/` and its subfolders, specify: `/path`;

    * `<link_lifetime>` — the link lifetime in seconds;

    * `<cdn_domain>` — the CDN resource domain, including the protocol. You can view the CDN resource domain in the [control panel](https://my.selectel.ru/cdn-v3/resources): in the top menu, click **Products** → **CDN** → **CDN Resources** → the CDN resource row.
  </TabItem>
</Tabs>

## Configure access by your own script \{#configure-access-by-own-script}

You can add your own script to authorize users.

When a user follows a link, the decision to allow content access is made based on the script response.

In the script, you must pass the following headers:

* `Host` — the domain name for which the request is intended;
* `X-Request-URI` — the URI of the requested CDN resource;
* `X-Forwarded-For` — the real IP address of the user requesting the CDN resource;
* `X-Remote-Addr` — the IP address of the user requesting the CDN resource, or the proxy server IP address.

1. In the [control panel](https://my.selectel.ru/cdn-v3), on the top menu, click **Products** and select **CDN**.

2. In the **CDN Resources** section, open the CDN resource page → **Restrictions**.

3. In the **Authorization** block, select **By external script**.

4. Insert the link to your script.

5. Click **Apply**. While settings are being applied, the CDN resource enters the `PROCESSING` status. You cannot apply other settings during this time. Settings take effect when the CDN resource transitions to `ACTIVE`.

<Formbricks />