CDN:Type F signing

How it works

• How a URL is signed based on type F signing

  URLs are signed in the following format:

  http://DomainName/FileName?{sign=<md5hash>&time=<timestamp>}

  Note

  • The content that is enclosed in braces ({}) indicates the encrypted information that is added to the standard URL.

  • URLs cannot contain Chinese characters.

  • URLs that contain parameters followed by a question mark (?) cannot be signed.

• Fields in a signed URL

  Field	Description
  DomainName	The accelerated domain name.
  PrivateKey	The cryptographic key that you specified. The key must be 16 to 32 characters in length, and can contain letters and digits.
  FileName	The actual URL that points to the requested resource on the origin server. The value of the Filename field must start with a forward slash (/).
  timestamp	The time when a signed URL is generated. The timestamp and the TTL value determine when a signed URL expires. The timestamp follows the UNIX time format. It is the number of seconds that have elapsed since 00:00:00 Thursday, January 1, 1970. The timestamp is a string that consists of 10 positive decimal integers and is irrelevant to the time zone. The decimal string is converted into a hexadecimal string. Note In most cases, the validity period of a signed URL equals the value of the TTL parameter. In some cases, the signing server also assigns a TTL value to a signed URL. Timestamp = UNIX timestamp on the signing server + TTL assigned by the signing server. Validity period of the signed URL = Timestamp + TTL that is configured on Alibaba Cloud CDN.
  md5hash	The string that is calculated by using the MD5 algorithm. The string must be 32 characters in length and can contain digits and lowercase letters. The md5hash value is calculated by using the following method: sstring = "Privatekey+URI+timestamp" (The URI specifies the address that points to the requested resource. The URI does not contain parameters such as /Filename.) md5hash = md5sum(sstring)

• Authentication logic

  When a point of presence (POP) receives a request, the POP determines whether the time that is calculated by adding the timestamp and the TTL values in the request is earlier than the current time.

  • If the time that is calculated by adding the timestamp and the TTL values in the request is earlier than the current time, the POP determines that the URL of the request expired and returns a 403 error.

  • If the time that is calculated by adding the timestamp and the TTL values in the request is later than the current time, an sstring is generated. Then, an md5hash value is generated based on the MD5 algorithm. The generated md5hash value is compared with the md5hash value in the request.

    • If the values are the same, the request passes the authentication. The POP returns the requested resource.

      Note

      If a request passes the authentication, URL signing parameters are removed from the URL to increase the cache hit ratio and reduce back-to-origin traffic.

      • For a URL that is signed in Format 1 or Format 2, the format of the URL that is used to generate a cache key is http://DomainName/FileName.

      • For a URL that is signed in Format 1 or Format 2, the format of the URL in the origin request is http://DomainName/FileName.

    • If the two values are different, the request fails the authentication. The POP returns the HTTP 403 status code.