CDN Access Control & Token Authentication 2 — Questions and Answers
Question 1: Which component in a CDN token-signing flow is considered the shared secret and must never be exposed publicly?
- The CDN edge node's IP address
- The HMAC signing key stored on both the origin application and CDN configuration (Correct answer)
- The user's session cookie value
- The expiry timestamp appended to the URL
Correct answer: The HMAC signing key stored on both the origin application and CDN configuration
The HMAC signing key is the shared secret that both the origin (when generating tokens) and the CDN (when validating tokens) must know; exposing it allows anyone to forge valid tokens.
Question 2: A CDN operator wants to restrict content so that a signed URL can only be used from the IP address that originally requested it. Which token parameter enables this binding?
- ip_acl or client_ip parameter included in the token signature (Correct answer)
- The Cache-Control: private header
- A Vary: X-Forwarded-For response header from the origin
- Setting a short TTL of 1 second on the signed URL
Correct answer: ip_acl or client_ip parameter included in the token signature
Including the client's IP address as a parameter in the token signature means the CDN edge will reject the token if the requesting IP doesn't match, preventing token sharing.
Question 3: What is 'token escalation' in the context of CDN security?
- Automatically renewing expired tokens without user interaction
- An attack where a low-privilege token is manipulated to gain access to restricted content (Correct answer)
- Upgrading a CDN plan to unlock token-based authentication features
- The process of increasing token expiry time during high-traffic events
Correct answer: An attack where a low-privilege token is manipulated to gain access to restricted content
Token escalation is a security vulnerability where an attacker modifies token parameters (e.g., changing path restrictions) to access content beyond what was originally authorized.
Question 4: For an OTT platform using a CDN, why is it recommended to use short-lived signed URLs (e.g., 5–15 minute expiry) for video segment delivery?
- Short-lived URLs improve CDN cache hit ratios
- Short expiry minimizes the window during which a leaked URL can be exploited by unauthorized users (Correct answer)
- CDN pricing is lower for URLs with shorter TTL values
- Short-lived URLs force the CDN to revalidate content freshness more frequently
Correct answer: Short expiry minimizes the window during which a leaked URL can be exploited by unauthorized users
Short expiry windows limit the damage from URL leakage—even if a signed URL is shared or stolen, it becomes useless quickly, protecting premium content.
Question 5: Which HTTP status code should a CDN return when a request is blocked due to a geo-restriction rule?
- 401 Unauthorized
- 403 Forbidden
- 404 Not Found
- 451 Unavailable For Legal Reasons (Correct answer)
Correct answer: 451 Unavailable For Legal Reasons
RFC 7725 defines HTTP 451 specifically for situations where content is unavailable due to legal demands including geographic licensing restrictions, making it the most semantically correct response.
Question 6: A company wants CDN edge nodes to authenticate API consumers without hitting the origin. Which approach allows stateless token verification at the edge?
- OAuth 2.0 authorization code flow with origin callback
- JWT tokens signed with a key the CDN edge nodes possess for local verification (Correct answer)
- Session cookies stored in a shared Redis cluster accessible to all edge nodes
- HTTP Basic Authentication forwarded transparently to the origin
Correct answer: JWT tokens signed with a key the CDN edge nodes possess for local verification
JWTs signed with an asymmetric or shared key allow CDN edge nodes to cryptographically verify the token locally without any round-trip to the origin or a central session store.
Question 7: What is a 'wildcard token' in CDN access control?
- A token that can be used an unlimited number of times regardless of expiry
- A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources (Correct answer)
- A master API key that bypasses all CDN security rules
- A token type that works across different CDN vendors without modification
Correct answer: A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources
A wildcard token uses a path prefix (e.g., `/videos/show-1/*`) in the signature so one token grants access to all segments under that path without signing each URL individually.
CDN Access Control & Token Authentication 2
Which component in a CDN token-signing flow is considered the shared secret and must never be exposed publicly?