Compared with access control methods such as IP, Referer, Cookie, and User-Agent blacklists or whitelists, URL authentication provides a more advanced content protection mechanism. This method allows authentication information, such as timestamps and encrypted strings, to be embedded in the content URL. When users request content from the CDN, they must include the required authentication parameters. The CDN then verifies this information and determines whether to allow or deny access, effectively preventing unauthorized use of content URLs.

How URL Authentication Works

A typical URL authentication workflow involves three main components: the content management server, the user, and the CDN edge server.

• Content Management Server: This server generates authenticated URLs based on predefined rules, including the authentication algorithm and key, and then returns these URLs to the client.
• User (Client): The user uses the authenticated URL to request content from the CDN edge server.
• CDN: The CDN edge server checks the authenticated URL received from the user and verifies the authentication information and timestamp to determine whether access should be granted or denied.

For example, if the URL that requires authentication is http://example.com/test.jpg, the process is as follows:

1. The user requests the content URL from the content management server.
2. The content management server generates a time-sensitive URL with a token string based on predefined rules, including the authentication algorithm and key, such as http://example.com/test.jpg?token=123, and returns it to the user.
3. The client uses the authenticated URL to request content from the CDN edge server.
4. The CDN edge server validates the authentication information in the URL to determine whether the request is legitimate. If authentication succeeds, the CDN serves the requested content. If authentication fails, access is denied.

How to Set Up URL Authentication

1. Log in to the Atomile Console and select the appropriate product.
2. Go to Configuration, locate the domain you want to configure, and click Edit Configuration.
3. In the left sidebar, go to Access Control - Token Authentication and click Modify.
4. Configure the Effective Range, Authentication Mode, and other settings according to your requirements.

Effective Range

Select the range of requests to which URL authentication applies:

Setting	Description
All Requests	The access control rule applies to all request types.
Only Homepage	Applies only to the root directory of the domain, such as http://domain/ or https://domain/.
Specified File Type	Applies only to specific file types. You can select predefined file types or define custom file types. Separate multiple custom types with a semicolon ;, for example, jpg;png.
Specified URI	Applies only to requests for content at a specific URI. Two URI matching options are available: Exact matching: Matches the complete URI, including query parameters, for example, path/index.html?abc=123. Ignore parameter matching: Matches the URI without query parameters, for example, path/index.html.
Specified Directory	Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*. Note: Directory paths must start and end with / and can contain only letters, numbers, and certain special characters (underscore, hyphen, percent sign, and period). Separate multiple directories with line breaks.
URL Pattern	Uses regular expressions to define the range of requests to which the rule applies. For example, the pattern .*\.jpg$ ensures that access control applies to all URLs ending with .jpg.

Authentication Mode

You can choose from five authentication modes available in the Atomile Console. Each mode is designed for different requirements and scenarios:

• Authentication Mode A and Mode B
• Authentication Mode C and Mode D
• Authentication Mode E

How to Verify Your URL Authentication

Because URL authentication settings can be complex, we recommend deploying the configuration to a test environment first to avoid affecting your production environment. After verifying that the configuration works as expected, you can apply it to the live environment. For detailed instructions on deploying configurations to a test environment, refer to Verify Configurations Through Pre-Deployment.

In addition, you can use the URL Authentication Generator available in the Atomile Console to automatically generate URL authentication parameters for testing and verify whether the authentication parameters can be successfully validated by the CDN edge server. For more information about this tool, see URL Authentication Generator.