CDN Access Control & Token Authentication 1 — Questions and Answers
Question 1: What is the primary purpose of token-based URL signing in a CDN?
- To compress content before delivery to end users
- To ensure only authorized users can access protected content by embedding a cryptographic signature in the URL (Correct answer)
- To route requests to the nearest edge node automatically
- To enable HTTP/2 push for static assets
Correct answer: To ensure only authorized users can access protected content by embedding a cryptographic signature in the URL
Token-based URL signing embeds a cryptographic signature (and often an expiry time) in the URL so the CDN edge can verify the request is authorized before serving content.
Question 2: Which hashing algorithm is most commonly used to generate HMAC-based secure tokens in CDN implementations?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
SHA-256 is the industry-standard choice for HMAC-based CDN token signing because it provides strong collision resistance and is recommended by modern security guidelines.
Question 3: Hotlink protection in a CDN primarily works by checking which HTTP header on incoming requests?
- Authorization
- Referer (Correct answer)
- X-Forwarded-For
- Cache-Control
Correct answer: Referer
Hotlink protection validates the Referer header to ensure requests originate from an allowed domain, blocking other sites from embedding your assets directly.
Question 4: A signed CDN URL contains the parameter `exp=1719878400`. What does this value represent?
- The file expiration age in seconds
- The Unix timestamp after which the token is no longer valid (Correct answer)
- The number of allowed downloads for the URL
- The cache TTL override in minutes
Correct answer: The Unix timestamp after which the token is no longer valid
The `exp` parameter is a Unix timestamp representing the exact point in time after which the CDN edge will reject requests using that signed URL.
Question 5: Which of the following is an advantage of signed cookies over signed URLs for CDN access control?
- Signed cookies require less server-side computation to verify
- Signed cookies allow access control across multiple files without modifying each individual URL (Correct answer)
- Signed cookies are stored on the CDN edge rather than the client browser
- Signed cookies bypass CDN caching entirely to improve security
Correct answer: Signed cookies allow access control across multiple files without modifying each individual URL
Signed cookies allow a single authentication token to grant access to an entire set of resources (e.g., an HLS video playlist and all its segments) without needing to sign every URL individually.
Question 6: What happens at the CDN edge when a request arrives with an expired signed URL token?
- The CDN forwards the request to the origin to re-validate the token
- The CDN returns a 403 Forbidden response (Correct answer)
- The CDN strips the token and serves the content anyway
- The CDN returns a 301 redirect to a login page automatically
Correct answer: The CDN returns a 403 Forbidden response
When the token's expiry timestamp has passed, the CDN edge immediately rejects the request with a 403 Forbidden response without contacting the origin.
Question 7: In CDN geo-restriction, which mechanism does the CDN use to determine a user's geographic location?
- GPS coordinates submitted by the user's browser
- The user's self-declared country during account registration
- IP-to-geolocation database mapping the client's IP address to a country (Correct answer)
- The Accept-Language HTTP header sent by the browser
Correct answer: IP-to-geolocation database mapping the client's IP address to a country
CDNs use IP geolocation databases that map IP address ranges to countries, enabling edge nodes to apply geo-restriction rules without requiring any user input.
CDN Access Control & Token Authentication 1
What is the primary purpose of token-based URL signing in a CDN?