Access Control & Token Authentication Flashcards

When integrating DRM (Digital Rights Management) with a CDN for premium video delivery, what role does the CDN typically play?

Answer: The CDN delivers encrypted content while a separate DRM license server handles key issuance to authenticated clients

In a CDN-DRM architecture, the CDN efficiently distributes encrypted content at scale while the DRM license server (Widevine, FairPlay, PlayReady) issues decryption keys only to authenticated, authorized clients.

What is the primary security risk of using long-lived (e.g., 30-day) signed URLs for distributing downloadable software installers?

Answer: The signed URL can be freely shared or reposted, allowing unlimited unauthorized downloads during the valid period

A long-lived signed URL can be redistributed (e.g., posted on forums) and used by anyone during the entire validity window, undermining access control for paid or restricted content.

Which CDN access control method involves configuring an allowlist of trusted IP ranges (e.g., corporate office CIDRs) at the edge?

Answer: IP-based ACL (Access Control List)

IP-based ACLs configure CDN edge nodes to allow or deny requests based on the client's source IP address or CIDR range, commonly used to restrict access to internal tools or B2B APIs.

Mutual TLS (mTLS) at the CDN edge is most appropriate for which use case?

Answer: Securing machine-to-machine API communication between known services and the CDN edge

mTLS requires both parties to present X.509 certificates, making it ideal for B2B or service-to-service scenarios where all clients are known and can be issued client certificates.

A CDN supports 'token revocation' by checking tokens against a blocklist. What is the main operational challenge of this approach?

Answer: The blocklist must be replicated to all edge nodes globally with low latency, adding complexity and potential inconsistency

Distributing a token blocklist to potentially hundreds of globally distributed edge PoPs in near-real-time is operationally complex and can introduce a revocation lag during propagation.

When a CDN is configured to pass an `Authorization` header from the client directly to the origin, what caching consideration is critical?

Answer: Responses to authorized requests must not be served from cache to other users; caching should be disabled or vary on the Authorization header

Caching responses that carry user-specific Authorization context and then serving them to different users would expose private data; such responses must be marked private or cached with a Vary: Authorization directive.

Which feature allows a CDN to enforce access control rules based on custom request attributes (e.g., query string values, custom headers) without modifying the origin application?

Answer: CDN Rules Engine (also called Edge Rules or Edge Logic)

A CDN Rules Engine lets operators define conditional logic at the edge—such as blocking requests missing a custom API key header—without any changes to the origin application code.