Cookies are data stored on a user’s local device by websites to identify the user and support session tracking. When a user revisits the same website, the original cookie is sent back to the server. Therefore, access control can be enforced based on the Cookie header. When a CDN edge server receives a client request, it checks the Cookie field in the HTTP request header and then allows or denies the request according to the configured rules.

How to Set Up a Cookie Access Rule

1. Log in to the Atomile Console and select the appropriate product.
2. Go to Configuration, locate the domain you want to configure, and click Edit Configuration.
3. In the left sidebar, go to Access Control - Cookie Access List and click Add.
4. Configure the settings according to your requirements.

Effective Range

This defines the range of requests to which the Cookie rule applies. You can choose from the following options:

Setting	Description
All Requests	The access control rule applies to all request types.
Only Homepage	Applies only to the root directory of the domain, such as http://domain/ or https://domain/.
Specified File Type	Applies only to specific file types. You can select predefined file types or define custom file types. Separate multiple custom types with a semicolon ;, for example, jpg;png.
Specified URI	Applies only to requests for content at a specific URI. Two URI matching options are available: Exact matching: Matches the complete URI, including query parameters, for example, path/index.html?abc=123. Ignore parameter matching: Matches the URI without query parameters, for example, path/index.html.
Specified Directory	Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*. Note: Directory paths must start and end with / and can contain only letters, numbers, and certain special characters (underscore, hyphen, percent sign, and period). Separate multiple directories with line breaks.
URL Pattern	Uses regular expressions to define the range of requests to which the rule applies. For example, the pattern .*\.jpg$ ensures that access control applies to all URLs ending with .jpg.

Cookie Type

You can configure either a Cookie blacklist or a Cookie whitelist.

Type	Description
Cookie Blacklist	Access is denied if the request cookies contain specified content.
Cookie Whitelist	Access is allowed only if the request cookies contain specified content.

Tips

• Use regular expressions to configure blacklist or whitelist rules. For example, the expression GOOGLE=70238C3E matches all requests whose cookies contain GOOGLE=70238C3E.
• The system supports only one whitelist rule. If multiple cookie conditions are required, they must all be included in the same whitelist rule.

Action

When the Cookie does not meet the configured rules and the request is denied by the CDN, choose whether to return an error directly or redirect the request to another URL.

• Deny Access: The CDN rejects the request and returns HTTP status code 403.
• Redirect URL: The CDN redirects the request to another URL.

Allow NULL Cookie

Determines whether requests with empty cookies are allowed, even when a whitelist has been configured.

Priority

When multiple access control rules are configured, the CDN applies them based on numerical priority. Higher numbers are evaluated first.

After you complete the configuration, click OK, and then click Next to submit your settings. To minimize potential disruption to your production environment, we strongly recommend performing a Pre-deploy test in a staging environment. This important step helps ensure that your configuration is correct before it goes live.

After you confirm that the settings are correct, click Deploy Now to apply them in the live environment. The configuration typically takes effect within 3 to 5 minutes. For more information about pre-deployment testing and validation, refer to Deploy the Configurations to Staging Environment for Validation.

Best Practices

Example 1: Configure a Cookie Blacklist

Access is denied for all requests whose cookies contain aaa.

In another example, access is denied for all requests whose cookies contain bbb or ccc.

Example 2: Configure a Cookie Whitelist

For all requests, access is allowed only if the request cookies contain aaa or bbb.

Notes

Do not configure Cookie blacklists and whitelists at the same time, as this may cause all CDN access to be denied and disrupt your online services. For example, if both a Cookie blacklist and whitelist are configured as shown below, all access requests may be denied.

Why Would All Access Be Denied?

1. When a request contains the Cookie value aaa, it matches the Cookie blacklist rule, and the CDN denies access.
2. Requests without the Cookie value aaa are not denied by the blacklist, but they still fail the whitelist rule, which allows access only when the Cookie contains aaa, and are therefore also denied.

If you need to configure both a blacklist and a whitelist, contact Atomile technical support for assistance to ensure the configuration is set up correctly.