CDN Token Authentication: Securing Content Access

July 27, 2026 · Mei-Lin Wu · 4 min read

Why Token Authentication

Not all content should be publicly accessible. Premium videos, paid downloads, internal documents — these need access control. Token authentication lets the CDN verify that each request is authorized before serving content, without requiring every request to hit the origin. For foundational context, read CDN DDoS Protection: How CDNs Absorb Volumetric Attacks — FlyFish NWA.

Signed URLs

The origin generates a URL containing a cryptographic signature. The CDN verifies the signature before serving the content. If the signature is invalid or expired, the request is rejected at the edge.

Performance Comparison: Edge vs Origin Processing
Metric	Edge Processing	Origin Processing	Improvement
Latency (p50)	8–15 ms	120–300 ms	15–20x faster
Cache Hit Ratio	85–95%	N/A	Reduces origin load
TLS Handshake	1–5 ms (nearby PoP)	50–150 ms	10–30x faster
Bandwidth Cost	$0.01–0.04/GB	$0.05–0.12/GB	3–5x cheaper
Availability	99.99% (multi-PoP)	99.9% (single DC)	10x fewer outages

Figure 1: CDN Security Architecture — Defense-in-depth protection layers

# Generate signed URL (application server)
base_url = "https://cdn.example.com/premium/video.mp4"
expiry = int(time.time()) + 3600  # 1 hour
token = hmac_sha256(secret_key, f"{base_url}|{expiry}")
signed_url = f"{base_url}?expires={expiry}&token={token}"

# CDN validates:
# 1. Token matches HMAC of URL + expiry using shared secret
# 2. Current time < expiry
# 3. If both pass → serve content

Signed URL Parameters

Parameter	Purpose	Example
Expiry time	URL becomes invalid after this time	3600 seconds from now
Client IP	Lock URL to specific IP	Prevent URL sharing
Path prefix	Allow access to a directory, not just one file	/premium/season1/*
Country restriction	Geo-restrict access	US, CA, UK only

JWT Validation at the Edge

For API-style access control, the CDN validates JSON Web Tokens at the edge:

Figure 2: Secure Request Flow — How requests pass through security layers

# Request with JWT
GET /api/data HTTP/1.1
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

# CDN validates:
# 1. Signature valid (using public key)
# 2. Token not expired (exp claim)
# 3. Issuer matches (iss claim)
# 4. Required claims present
# → Forward to origin with validated claims in headers

JWT validation at the edge means unauthenticated requests never reach origin. The CDN can also extract claims and pass them as headers, so origin receives pre-validated identity information.

CDN Implementation

CloudFront — Signed URLs and signed cookies (URL signing with RSA key pairs)
Cloudflare — Token authentication via Workers (edge compute) or Cloudflare Access
Akamai — EdgeAuth token authentication (HMAC-based URL signing)
Fastly — Token validation via VCL or Compute@Edge

Signed Cookies vs Signed URLs

Method	Best For	Limitation
Signed URLs	Individual files (video, download)	URL changes for each user/session
Signed cookies	Access to multiple URLs (entire section)	Requires cookie support in client

Token Security Best Practices

Short expiry times — 1-4 hours for media, 15-60 minutes for downloads
IP binding where possible — prevents URL sharing
Rotate signing keys periodically — CDNs support key rotation without downtime
Use asymmetric keys (RSA, ECDSA) for JWTs — origin keeps private key, CDN validates with public key
Log rejected tokens — monitor for brute force or token forging attempts

Token Authentication and Caching

Token-authenticated content can still be cached at the CDN. The key is separating the authentication check (per-request) from the content delivery (from cache). The CDN validates the token, then serves the content from cache if available. See cache key design — the token itself should NOT be part of the cache key.