Edge Acceleration
  • Site Acceleration
    • Overview
    • Access Control
      • Token authentication
        • Token Authentication
        • Authentication Method A
        • Authentication Method B
        • Authentication Method C
        • Authentication Method D
        • Authentication Method V
    • Smart Acceleration
    • Cache configuration
      • Overview
      • EdgeOne caching rules introduction
        • Content Cache Rules
        • Cache Key Introduction
        • Vary Feature
      • Cache Configuration
        • Custom Cache Key
        • Node Cache TTL
        • Status Code Cache TTL
        • Browser Cache TTL
        • Offline Caching
        • Cache Prefresh
      • Clear and Preheat Cach
        • Cache Purge
        • URL Pre-Warming
        • Prefetch M3U8
      • How to improve the Cache Hit Rate of EdgeOne
    • File Optimization
      • Content Compression
      • Smart Compression
    • Network Optimization
      • HTTP/2
      • HTTP/3(QUIC)
        • Overview
        • Enable HTTP/3
        • QUIC SDK
          • SDK Overview
          • SDK Download and Integration
          • Sample Code
            • Android
            • iOS
          • API Documentation
            • Android
            • iOS
      • IPv6 Access
      • Maximum Upload Size
      • WebSocket
      • Client IP Geolocation Header
      • Client IP Geographical Location
      • gRPC
      • Network Error Logging
    • URL Rewrite
      • Access URL Redirection
      • Origin-Pull URL Rewrite
    • Modifying Header
      • Modifying HTTP Response Headers
      • Modifying HTTP Request Headers
    • Modify response content
      • HTTP Response
      • Custom Error Page
    • Rules Engine
      • Overview
      • Rule Management
      • variables
      • Supported Matching Types and Actions
    • Image and video processing
      • Audio and Video Pre-pulling
      • Just-in-Time Image Processing
      • Video Just-In-Time Processing
      • VOD Media Origin
    • Speed limit for single connection download
    • Request and Response Actions
      • HTTP Response
      • Processing order
      • Default HTTP Headers of Origin-Pull Requests
      • Default HTTP Response Headers
      • HTTP Restrictions
    • Media Services
      • Audio and Video Pre-pulling
      • Just-in-Time Image Processing
      • Just-in-Time Media Processing
      • VOD Media Origin
  • L4 Proxy
    • Overview
    • Creating an L4 Proxy Instance
    • Modifying an L4 Proxy Instance
    • Disabling or Deleting an L4 Proxy Instance
    • Batch Configuring Forwarding Rules
    • Obtaining Real Client IPs
      • Obtaining Real TCP Client IPs via TOA
      • Obtaining Real Client IPs Through Protocol V1/V2
        • Overview
        • Method 1: Obtaining Real Client IPs Through Nginx
        • Method 2: Parsing Real Client IPs on Application Server
        • Format of Real Client IPs Obtained Through Proxy Protocol V1/V2
      • Transmitting Client Real IP via SPP Protocol
  • Domain name service and origin server configuration
    • Domain Name Services
      • Overview
      • DNS resolution for managed domains
        • Modifying DNS Servers
        • Configuring DNS Records
        • Batch Importing DNS Records
        • Advanced DNS Configuration
      • Access accelerated domains
        • Adding A Domain Name for Acceleration
        • Ownership Verification
        • Modifying CNAME Records
        • Verify Business Access
      • Traffic scheduling
        • Traffic Scheduling Management
    • HTTPS Certificate
      • Overview
      • Edge HTTPS Certificate
        • Overview
        • Deploying/Updating SSL Certificate for A Domain Name
        • Configuring A Free Certificate for A Domain Name
        • Using Keyless Certificate
      • Edge mTLS Authentication
      • Origin Certificate Validation
      • HTTPS configuration
        • Forced HTTPS Access
        • Enabling HSTS
        • SSL/TLS security configuration
          • Configuring SSL/TLS Security
          • TLS Versions and Cipher Suites
        • Enabling OCSP Stapling
      • Related References
        • Using OpenSSL to Generate Self-Signed Certificates
        • Certificate Format Requirements
        • The Difference Between one-way authentication and Mutual authentication
    • Origin Configuration
      • Load Balancing
        • Overview
        • Quickly Create Load Balancers
        • Health Check Policies
        • Viewing the Health Status of Origin Server
        • Related References
          • Load Balancing-Related Concepts
          • Introduction to Request Retry Strategy
      • Origin Group Configuration
      • Origin configuration
        • Origin-Pull Timeout
        • Configuring Origin-Pull HTTPS
        • Host Header Rewrite
        • Controlling Origin-pull Requests
        • Redirect Following During Origin-Pull
        • HTTP/2 Origin-Pull
        • Range GETs
        • Modify Origin
        • Origin-pull Rate Limiting Policy
      • Origin Protection(Obtaining/Updating Origin IP Address Range)
      • Related References
        • ld Version Origin Group Compatible Related Issues
Docs Overview/
Edge Acceleration/
Site Acceleration/
Access Control/
Token authentication/
Authentication Method C/

Authentication Method C

Authentication URL Format

http://Hostname/md5hash/timestamp/Filename
https://Hostname/md5hash/timestamp/Filename

Parameter description

Field
Description
Hostname
Site Acceleration Domain.
Path
Resource access path, authentication requires prefixing with /.
timestamp
Unix timestamp in hexadecimal form (the total number of seconds from 00:00:00, January 1, 1970, UTC time to now, regardless of the time zone)
md5hash
A fixed-length string of 32 characters calculated using the MD5 algorithm:
Algorithm: MD5(Key + Path + timestamp). Note: When calculating, the hexadecimal timestamp must filter out the hexadecimal number identification 0x.
Authentication Logic: If the request has not expired, the node compares this string value with the md5hash value carried in the request URL. If the values are the same, authentication passes, and the request is responded to; if the values are different, authentication fails, returning 403.

Configuration Samples

Assuming the request URL https://www.example.com/foo.jpg uses authentication method C, Since this method prepends the authentication information /{md5hash}/{timestamp} before the actual resource path, the actual URL Path when the request reaches the node is /{md5hash}/{timestamp}/foo.jpg. The rule engine's「URL Path」matching operates on the original request path carrying the authentication prefix, not the actual business path.
Therefore, the matching condition must use "Regular Expression Matching" to include the authentication prefix. It cannot be configured based on the actual business path (for example, URL Path equals /foo.jpg), otherwise the request will fail to match the rule.A configuration example is provided below:


Get authentication parameters:

Path：/foo.jpg.
timestamp: The server-generated time for the authentication URL is 2024-07-15 15:43:06 (UTC+8), converted to hexadecimal (Unix timestamp) format is 6694d30a.
Key: DvYmqE81E1F9R791H6lmht.
md5hash: MD5(Key + Path + timestamp) = MD5(DvYmqE81E1F9R791H6lmht/foo.jpg6694d30a) = 6688749e8906a726c12fe1be3aacd016.

Authentication URL generated by the client request

https://www.example.com/6688749e8906a726c12fe1be3aacd016/6694d30a/foo.jpg.

Node Authentication

When the Node Server receives a request sent by the client via an encrypted URL, it parses the timestamp parameter from the URL, adds the configured effective duration of "1 second", and compares it with the current time:
1. exceed the "timestamp + effective duration" time, the request is not expired, continue to step 2.
2. The Node Server calculates the md5hash value using the obtained authentication parameters and compares it with the md5hash value carried in the request URL. If the values are the same, authentication passes and the request is responded to; if the values are different, authentication fails, returning 403.
3. After node authentication passes, the system automatically strips the /{md5hash}/{timestamp} prefix and uses the actual business path /foo.jpg to fetch content from the origin.