When a client sends a request to a web server, it usually includes a Referer header that indicates which page the request came from. Based on this header, access control can be enforced. When a CDN edge server receives a client request, it checks the Referer field in the HTTP request header and then allows or denies the request according to the configured rules.

This feature is suitable for scenarios where content should be accessible only from specific pages, such as when users are allowed to access resources only by clicking links on designated pages.

How to Set Up a Referer Access Rule

1. Log in to the Atomile Console and select the appropriate product.
2. Go to Configuration, locate the domain you want to configure, and click Edit Configuration.
3. In the left sidebar, go to Access Control - Referer Access List and click Add.
4. Configure the settings according to your requirements.

Effective Range

This defines the range of requests to which the Referer rule applies. You can choose from the following options:

Setting	Description
All Requests	The access control rule applies to all request types.
Only Homepage	Applies only to the root directory of the domain, such as http://domain/ or https://domain/.
Specified File Type	Applies only to specific file types. You can select predefined file types or define custom file types. Separate multiple custom types with a semicolon ;, for example, jpg;png.
Specified URI	Applies only to requests for content at specific URIs. Two matching options are available: Exact matching: Matches the complete URI, including query parameters, for example, path/index.html?abc=123. Ignore parameter matching: Matches the URI without query parameters, for example, path/index.html.
Specified Directory	Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*. Note: Directory paths must start and end with / and can contain only letters, numbers, and certain special characters (underscore, hyphen, percent sign, and period). Separate multiple directories with line breaks.
URL Pattern	Uses regular expressions to define the range of requests to which the rule applies. For example, the pattern .*\.jpg$ ensures that access control applies to all URLs ending with .jpg.

Referer Type

You can configure either a Referer blacklist or a Referer whitelist.

Setting	Description
Blacklist	Two options are available: Referer blacklist (Domain): Access is denied if the Referer contains the specified domain, for example, www.test.com. You do not need to add http:// or https:// before the domain. Referer blacklist (URL): Access is denied if the Referer contains the specified URL, for example, http://www.test.com/index.html.
Whitelist	Two options are available: Referer whitelist (Domain): Access is allowed only if the Referer contains the specified domain, for example, www.test.com. You do not need to add http:// or https:// before the domain. Referer whitelist (URL): Access is allowed only if the Referer contains the specified URL, for example, http://www.test.com/index.html.

Tips

• Blacklists and whitelists can contain multiple domains or URLs, separated by line breaks.
• The system supports only one whitelist rule. If multiple Referer values are required, they must all be included in the same whitelist rule.
• Wildcard domains are not supported in either the whitelist or blacklist.

Action

When the Referer does not meet the configured rules and the request is denied by the CDN, choose whether to return an error directly or redirect the request to another URL.

• Deny Access: The CDN rejects the request and returns HTTP status code 403.
• Redirect URL: The CDN redirects the request to another URL.

Allow NULL Referer

If enabled, users can access your content directly by entering the URL in the browser address bar, even if no Referer is present.

Priority

When multiple access control rules are configured, the CDN applies them based on numerical priority. Higher numbers are evaluated first.

After you complete the configuration, click OK, and then click Next to submit your settings. To minimize potential disruption to your production environment, we strongly recommend performing a Pre-deploy test in a staging environment. This important step helps ensure that your configuration is correct before it goes live.

After you confirm that the settings are correct, click Deploy Now to apply them in the live environment. The configuration typically takes effect within 3 to 5 minutes. For more information about pre-deployment testing and validation, refer to Deploy the Configurations to Staging Environment for Validation.

Notes

Do not configure Referer blacklists and whitelists at the same time. The Referer is checked against both sets of rules in sequence, which may cause all CDN access to be denied and affect your business.

For example, if both a Referer blacklist and whitelist are configured as shown below, all access requests will be denied by the CDN.

Why Would All Requests Be Denied?

1. Requests with a Referer containing www.test.com are denied by the CDN because they match the blacklist rule.
2. Requests without www.test.com in the Referer are not denied by the blacklist, but they are still denied because they do not match the whitelist rule, which allows access only when the Referer contains www.test.com.

If you need to configure both a blacklist and a whitelist, contact Atomile technical support for assistance to ensure the configuration is set up correctly.