This document provides detailed explanations of Authentication Mode A and Mode B, along with instructions for how to use them.

Authentication URL Structure

Atomile provides Authentication Mode A and Mode B, which allow authentication information to be embedded directly in the URL path. The URL formats for these two modes are as follows:

Authentication Mode A

http://domain/<time>/<key>/uri

Authentication Mode B

http://domain/<key>/<time>/uri

In these URL structures, <key> and <time> are authentication parameters. The CDN edge server verifies this information to determine whether to serve the requested content. Note that the order of <key> and <time> in Modes A and B is fixed and cannot be changed.

The symbols <> indicate the positions of the authentication parameters. These symbols do not appear in the actual URL.

Explanation of Fields in the Authentication URL

Field	Description
domain	The domain you have added to Atomile.
time	The timestamp in the authentication URL, which indicates when the URL was generated. The CDN edge server uses this timestamp to determine whether the URL is still valid. If the current time exceeds the valid period of the URL, the content will not be served. The time value must use one of the supported timestamp formats; otherwise, authentication fails. For supported timestamp formats, see the Time Format section below.
key	The encrypted signature used for authentication verification. It is typically generated by combining the timestamp time, the authentication key ourkey, and the actual path uri. For details on how this parameter is calculated, see the Signature Calculation Parameters section below.
uri	The actual path of the URL used to request content from the CDN. For example, if the original request URL is http://atomile.com/browse/index.html, the uri is /browse/index.html. If the request URL includes query parameters, for example, /browse/index.html?user=123, the uri should include only the path of the requested object and exclude the query string.

How Authentication Works on CDN Edge Servers

When the CDN edge server receives a request, it first checks whether the timestamp time in the authentication URL has expired:

• If time plus the valid duration is earlier than the current time, the URL is considered expired, access is denied, and HTTP status code 403 is returned.
• If time plus the valid duration is equal to or later than the current time, the CDN edge server considers the URL valid in terms of time. It then calculates the expected authentication signature (key) for the request URL and compares it with the signature in the request. If they match, authentication succeeds and the server returns the requested content. Otherwise, the request is denied and HTTP status code 403 is returned.

How to Configure Mode A and Mode B

In Authentication Modes, select Mode A or Mode B as needed. The following sections explain each configuration item.

Authentication Key ($ourkey)

The Authentication Key ($ourkey) is a unique string used to generate the authentication signature key in the URL. This key is shared only between you and Atomile CDN servers, which improves security by making the authentication parameters more difficult to forge.

You can configure multiple ourkey values in the console, separated by semicolons (;).

When multiple ourkey values are configured, the CDN edge server tries them in order during authentication. If the first ourkey fails, the server tries the next one, and so on, until a valid key is found or all keys fail validation.

Time Format

The time field in the authentication URL supports the following five formats to meet different requirements:

Timestamp Format	Description
Decimal Unix Timestamp	For example, 1586338211 represents April 8, 2020, 17:30:11 UTC.
Hexadecimal Unix Timestamp	For example, 5e8e2463 represents 1586338211 in hexadecimal.
Millisecond-level Unix Timestamp	For example, 1586338211000 represents the same point in time in milliseconds.
YYYYMMDDHHMMSS	For example, 20200408173011 represents April 8, 2020, 17:30:11.
YYYYMMDDHHMM	For example, 202004081730 represents April 8, 2020, 17:30.

Signature Calculation Algorithm

The signature key is generated using an encryption algorithm. By default, Atomile uses the MD5 algorithm. If you require a different algorithm for stronger security, contact Atomile technical support for assistance.

Signature Calculation Parameters

To generate the authentication signature key, you can include the following parameters: time, ourkey, and uri. For detailed definitions of these fields, refer to the Explanation of Fields in the Authentication URL section above.

When constructing the source string for encryption, you can choose one or more of these parameters and define their order. For example, if you select $uri$ourkey$time, the concatenation order is:

• The request path (uri) first
• The custom authentication key (ourkey) second
• The timestamp (time) last

For example, if the URL is http://atomile.com/browse/index.html, the ourkey is atomile, and the time is 202405131620, the source string before encryption is:

/browse/index.htmlatomile202405131620

Valid Time (Seconds)

Atomile provides three methods for configuring the validity period of the authentication information:

• Upper Limit of Validity Period: Enter a non-negative integer, for example, 60, to set the maximum validity period in seconds after the time value. For example, 60 means the authentication information remains valid for one minute after the timestamp in the request URL.
• Upper and Lower Limits of Validity Period: Enter two comma-separated values. The first value is the number of seconds before the timestamp (<= 0), and the second value is the number of seconds after the timestamp (>= 0). For example, -60,60 means the authentication information is valid from one minute before the timestamp to one minute after it.
• No Validity Period Validation: Enter a minus sign (-) to disable validity period checks.

The Positions of key and time Are Interchangeable

This option determines whether the positions of key and time in the request URL can be swapped. However, in Mode A and Mode B, the positions of key and time are fixed and must follow the specified order. Therefore, this option does not apply to Modes A and B.

Quickly Verify Whether the URL Authentication Configuration Is Correct

To avoid affecting your production environment, we recommend first deploying the configuration to a staging environment. After you confirm that the configuration is correct, you can deploy it to the live environment. For details about staging deployment, refer to Deploy the Configurations to Staging Environment for Validation.

In addition, you can use the URL Authentication Generator in the Atomile Console to generate URL authentication parameters and quickly verify your configuration. For more information, refer to Authentication URL Generator.