1
votes

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html#private-content-how-signed-cookies-work

The instruction 1-4 step was successfully implement, but i do not know how to proceed with the client-side, after browser got the cookies...Can anyone can share with me some code? Or point to the right direction? Your help is highly appreciated.

The user requests an object.

The user's browser or other viewer gets the name-value pairs from step 4 and adds them to the request in a Cookie header. This is the signed cookie.

CloudFront uses the public key to validate the signature in the signed cookie and to confirm that the cookie hasn't been tampered with. If the signature is invalid, the request is rejected.

If the signature in the cookie is valid, CloudFront looks at the policy statement in the cookie (or constructs one if you're using a canned policy) to confirm that the request is still valid. For example, if you specified a beginning and ending date and time for the cookie, CloudFront confirms that the user is trying to access your content during the time period that you want to allow access.

If the request meets the requirements in the policy statement, CloudFront serves your content as it does for content that isn't restricted: it determines whether the object is already in the edge cache, forwards the request to the origin if necessary, and returns the object to the user.

This is where i stuck, i got signed cookie, and response.addcookie to the response header, is it like this? request header does not able to addheader or add cookie... then how do i proceed with next? i lack of experience in dueling with cookie, i done with signed url for rtmp distribution but not for http distribution (signed cookies)

enter image description here

1

1 Answers

-1
votes

Once you have the CloudFront cookie saved to the browser for the specific domain i.e. subdomain.mydomain.com or .mydomain.com as a wildcard cookie.

Then with each request to the host (domain) the CF cookie will be sent via http request headers.

CF will decrypt the ticket in the cookie and validate your request, you only need to give permissions to the S3 bucket for the CF origin ID specified in the CF Origin Identities in the CF console.

So say you have an image requested @ https://mycdn.mydomain.com/myimage.jpg which is the CNAME DNS address and edge cache for origin https://s3.amazonaws.com/mybucket/images/myimage.jpg, or you might be using the default cloudfront.net address that will be the case if your not using your own CNAME entry.

Then your domain CF cookie would be sent and permission validated and then the response to the browser will be your image.

I hope this helps; If not this may be of some use.

http://www.spacevatican.org/2015/5/1/using-cloudfront-signed-cookies/