Access Control & Token Authentication Flashcards

Which component in a CDN token-signing flow is considered the shared secret and must never be exposed publicly?

Answer: The HMAC signing key stored on both the origin application and CDN configuration

The HMAC signing key is the shared secret that both the origin (when generating tokens) and the CDN (when validating tokens) must know; exposing it allows anyone to forge valid tokens.

A CDN operator wants to restrict content so that a signed URL can only be used from the IP address that originally requested it. Which token parameter enables this binding?

Answer: ip_acl or client_ip parameter included in the token signature

Including the client's IP address as a parameter in the token signature means the CDN edge will reject the token if the requesting IP doesn't match, preventing token sharing.

What is 'token escalation' in the context of CDN security?

Answer: An attack where a low-privilege token is manipulated to gain access to restricted content

Token escalation is a security vulnerability where an attacker modifies token parameters (e.g., changing path restrictions) to access content beyond what was originally authorized.

For an OTT platform using a CDN, why is it recommended to use short-lived signed URLs (e.g., 5–15 minute expiry) for video segment delivery?

Answer: Short expiry minimizes the window during which a leaked URL can be exploited by unauthorized users

Short expiry windows limit the damage from URL leakage—even if a signed URL is shared or stolen, it becomes useless quickly, protecting premium content.

Which HTTP status code should a CDN return when a request is blocked due to a geo-restriction rule?

Answer: 451 Unavailable For Legal Reasons

RFC 7725 defines HTTP 451 specifically for situations where content is unavailable due to legal demands including geographic licensing restrictions, making it the most semantically correct response.

A company wants CDN edge nodes to authenticate API consumers without hitting the origin. Which approach allows stateless token verification at the edge?

Answer: JWT tokens signed with a key the CDN edge nodes possess for local verification

JWTs signed with an asymmetric or shared key allow CDN edge nodes to cryptographically verify the token locally without any round-trip to the origin or a central session store.

What is a 'wildcard token' in CDN access control?

Answer: A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources

A wildcard token uses a path prefix (e.g., `/videos/show-1/*`) in the signature so one token grants access to all segments under that path without signing each URL individually.