Signed URLs

Overview #

Flumotion Smart Multi CDN allows you to protect access to your content using Signed URLs.

This feature requires CDNs to verify a signature before granting access to protected content. For an end user to access the content, the requested URL must include a valid signature in the query string.

The Flumotion Smart Multi CDN Signed URLs feature generates a single signature that can be verified across all CDNs configured for your service.

The URL accessed by the end user should follow this format:

https://test.example.com/some-resource&YourQueryParams&SignatureQueryParams

The SignatureQueryParams component must be generated by your backend and is then verified by the different CDNs.

Configuring Keys #

Signed URLs use keys to verify signatures.

To add a verification key:

1. Navigate to your service.
2. In the sidebar, under Security, select Signed URLs.
3. Click the Add New Key button.
4. Complete the key creation form:

• Key Name – Enter a name for the new key.
• Choose whether to create the keys yourself or click Generate Keys to generate them automatically.
• If you create the keys manually, provide the Public Key and Encryption Key.

Note: It is crucial to securely store both the Private Key and the Encryption Key, as both are required to generate signatures.

Once created, the new key will appear in the list of keys.

Click the code icon to retrieve and copy the provider-specific key information.

Refer to Generating Signatures for instructions on how to generate signatures.

Configuring Behavior #

To enable Signed URLs for your traffic, you need to configure the appropriate Behavior.

To create a Behavior:

1. Navigate to your service.
2. Go to the Behaviors tab.
3. Click the Add New Behavior button.
4. Complete the Behavior configuration form:

• Name – Enter the name of the new Behavior.
• Path Pattern – Provide a wildcard expression identifying the paths where the Behavior should apply.
• Click Add Action.
• From the Action Type dropdown, select URL Signing and enable it.

Important: Once this Behavior is enabled, requests to the protected content that do not contain a valid signature will be blocked by the CDNs.