Access Control & Token Authentication Flashcards

What is the primary purpose of token-based URL signing in a CDN?

Answer: To ensure only authorized users can access protected content by embedding a cryptographic signature in the URL

Token-based URL signing embeds a cryptographic signature (and often an expiry time) in the URL so the CDN edge can verify the request is authorized before serving content.

Which hashing algorithm is most commonly used to generate HMAC-based secure tokens in CDN implementations?

Answer: SHA-256

SHA-256 is the industry-standard choice for HMAC-based CDN token signing because it provides strong collision resistance and is recommended by modern security guidelines.

Hotlink protection in a CDN primarily works by checking which HTTP header on incoming requests?

Answer: Referer

Hotlink protection validates the Referer header to ensure requests originate from an allowed domain, blocking other sites from embedding your assets directly.

A signed CDN URL contains the parameter `exp=1719878400`. What does this value represent?

Answer: The Unix timestamp after which the token is no longer valid

The `exp` parameter is a Unix timestamp representing the exact point in time after which the CDN edge will reject requests using that signed URL.

Which of the following is an advantage of signed cookies over signed URLs for CDN access control?

Answer: Signed cookies allow access control across multiple files without modifying each individual URL

Signed cookies allow a single authentication token to grant access to an entire set of resources (e.g., an HLS video playlist and all its segments) without needing to sign every URL individually.

What happens at the CDN edge when a request arrives with an expired signed URL token?

Answer: The CDN returns a 403 Forbidden response

When the token's expiry timestamp has passed, the CDN edge immediately rejects the request with a 403 Forbidden response without contacting the origin.

In CDN geo-restriction, which mechanism does the CDN use to determine a user's geographic location?

Answer: IP-to-geolocation database mapping the client's IP address to a country

CDNs use IP geolocation databases that map IP address ranges to countries, enabling edge nodes to apply geo-restriction rules without requiring any user input.