Table of Contents

• Authentication URL Structure
  • Explanation of Fields in the Authentication URL
  • How Authentication Works on CDN Edge Servers
• How to Configure Mode C and Mode D
  • Authentication Key ($ourkey)
  • Time Format
  • Signature Calculation Algorithm
  • Signature Calculation Parameters
  • Signature Parameter Name
  • Timestamp Parameter Name
  • Valid Time (Seconds)
  • Key and Time Positions Interchangeable
• Quickly Verify Whether the URL Authentication Configuration Is Correct

This document provides a detailed explanation of Authentication Mode C and Mode D, along with instructions on how to use them.

Authentication URL Structure

Authentication Mode C and Mode D allow you to embed authentication information as query parameters in the URL. The URL formats for these two modes are as follows:

Authentication Mode C

http://domain/uri?key=signature&time=timestamp

Authentication Mode D

http://domain/uri?time=timestamp&key=signature

In these URL structures, key represents the authentication signature, and time represents the timestamp when the URL was generated. These authentication parameters are added to the URL, and the CDN edge server verifies them to determine whether to serve the requested content.

Similar to Authentication Mode A and Mode B, once configured, the order of key and time is fixed. Client requests must include these parameters in the specified order; otherwise, the CDN edge server rejects the request.

In Modes C and D, key and time are query parameters whose names can be customized. For instructions on how to change the names of these authentication parameters, refer to the Signature Parameter Name and Timestamp Parameter Name sections.

Explanation of Fields in the Authentication URL

Field	Description
domain	The domain you have added to Atomile.
uri	The actual path of the URL used to request content from the CDN. For example, if the original request URL is http://atomile.com/browse/index.html, the uri is /browse/index.html. If the request URL includes query parameters, for example, /browse/index.html?user=123, the uri should include only the path of the requested object and exclude the query string.
time	The timestamp in the authentication URL, which indicates when the URL was generated. The CDN edge server uses this timestamp to determine whether the URL is still valid. If the current time exceeds the valid period of the URL, the content will not be served. The time value must use one of the supported timestamp formats; otherwise, authentication fails. For supported timestamp formats, see the Time Format section.
key	The encrypted signature used for authentication verification. It is typically generated by combining the timestamp time, the authentication key ourkey, and the actual path uri. For details on how this authentication parameter is calculated, refer to the Signature Calculation Parameters section.

How Authentication Works on CDN Edge Servers

When the CDN edge server receives a request, it first checks whether the timestamp time in the authentication URL has expired:

• If time plus the valid duration is earlier than the current time, the URL is considered expired, access is denied, and HTTP status code 403 is returned.
• If time plus the valid duration is equal to or later than the current time, the CDN edge server considers the URL valid in terms of time. It then calculates the expected authentication signature (key) for the request URL and compares it with the signature in the request. If they match, authentication succeeds and the server returns the requested content. Otherwise, the request is denied and HTTP status code 403 is returned.

How to Configure Mode C and Mode D

In the Authentication Modes settings, select Mode C or Mode D as needed. The following sections describe each configuration item.

Authentication Key ($ourkey)

The Authentication Key ($ourkey) is a unique string used to generate the authentication signature key in the URL. This key is shared only between you and Atomile CDN servers, which improves security by making the authentication parameters difficult for unauthorized parties to forge.

You can configure multiple ourkey values in the console, separated by semicolons (;).

When multiple ourkey values are configured, the CDN edge server tries them in order during authentication. If the first ourkey fails, the server tries the next one, and so on, until a valid key is found or all keys fail validation.

Time Format

The time field in the authentication URL supports the following five formats to meet different requirements:

Timestamp Format	Description
Decimal Unix Timestamp	For example, 1586338211 represents April 8, 2020, 17:30:11 UTC.
Hexadecimal Unix Timestamp	For example, 5e8e2463 represents 1586338211 in hexadecimal.
Millisecond-level Unix Timestamp	For example, 1586338211000 represents the same point in time in milliseconds.
YYYYMMDDHHMMSS	For example, 20200408173011 represents April 8, 2020, 17:30:11.
YYYYMMDDHHMM	For example, 202004081730 represents April 8, 2020, 17:30.

Signature Calculation Algorithm

The signature key is generated using an encryption algorithm. By default, Atomile uses the MD5 algorithm. If you need a different encryption algorithm for stronger security, contact Atomile technical support for assistance.

Signature Calculation Parameters

To generate the authentication signature key, you can optionally include the following parameters: time, ourkey, and uri. For detailed explanations of these fields, refer to the Explanation of Fields in the Authentication URL section.

When constructing the source string for encryption, you can choose one or more of the above parameters and specify their order. For example, if you choose $uri$ourkey$time as the combination order, it means:

• The request path (uri) comes first.
• The custom authentication key (ourkey) comes next.
• The timestamp (time) comes last.

For example, with the URL http://atomile.com/browse/index.html, an ourkey of atomile, and a time of 202405131620, the generated source string before encryption is:

/browse/index.htmlatomile202405131620

Signature Parameter Name

This refers to the name of the authentication signature parameter in the URL. By default, the system uses key. For example, in Mode C:

http://domain/uri?key=signature&time=timestamp

You can customize this name as needed. For example, if you change it to testkey, the user can use the query parameter testkey=abc instead of key=abc in the URL to request content from the CDN edge server.

Timestamp Parameter Name

This refers to the name of the timestamp parameter in the URL. By default, the system uses time. You can also customize this parameter name as needed. For example, if you change it to testtime, the user can use the query parameter testtime=123 instead of time=123 to represent the timestamp in the URL when requesting content from the CDN edge server.

Valid Time (Seconds)

Atomile provides three methods for configuring the validity period of the authentication information:

• Upper Limit of Validity Period: Enter a non-negative integer, for example, 60, to set the maximum validity period in seconds after the time value. For example, 60 means the authentication information remains valid for one minute after the timestamp in the request URL.
• Upper and Lower Limits of Validity Period: Enter two comma-separated values. The first value is the number of seconds before the timestamp (<= 0), and the second value is the number of seconds after the timestamp (>= 0). For example, -60,60 means the authentication information is valid from one minute before the timestamp to one minute after it.
• No Validity Period Validation: Enter a minus sign (-) to disable validity period checks.

Key and Time Positions Interchangeable

By default, in Modes C and D, the positions of the authentication signature and timestamp parameters (key and time) in the URL are fixed and must follow the specified order of the selected authentication mode. If you set this option to Yes, their positions can be interchanged.

For example, the following two URLs are both considered valid by the CDN edge server, and the content is served to the client:

http://atomile.com/browse/index.html?key=abc&time=123

http://atomile.com/browse/index.html?time=123&key=abc

Quickly Verify Whether the URL Authentication Configuration Is Correct

To avoid affecting your production environment, we recommend first deploying the configuration to a test environment. After you confirm that the configuration is correct, you can apply it to the live environment. For details on deploying configurations to a test environment, refer to Deploy the Configurations to Staging Environment for Validation.

In addition, you can use the URL Authentication Generator available in the Atomile Console to generate URL authentication parameters and quickly verify your configuration. For more information, refer to Authentication URL Generator.