Protecting Premium Assets with Signed URLs

When distributing premium media, software binaries, or private documents, protecting assets from unauthorized hotlinking and leakage is a critical business requirement. Simply hiding files behind obscure URLs is not security; once a link is leaked, it can be shared publicly, leading to data breaches and soaring bandwidth bills.

Historically, applications verified access by routing all file requests through an application server that checked credentials against a database before streaming the file. However, this centralized approach adds significant latency, introduces a single point of failure, and disables the caching benefits of global Content Delivery Networks (CDNs). The modern standard for secure, scalable asset distribution is cryptographic Signed URLs validated directly at the edge.

The Cryptography of Signed URLs

A Signed URL is a standard URL that includes tokenized query parameters containing access constraints (such as expiration timestamps or client IP limits) and a cryptographic signature. The signature is generated using a Hash-based Message Authentication Code (HMAC) with a secure hashing algorithm like SHA-256, or using asymmetric keys (such as RSA-SHA256 or ECDSA).

When the CDN edge node receives the request, it verifies the signature against a shared secret key. If the signature is valid and the access constraints (e.g., the current timestamp is less than the expiration timestamp) are satisfied, access is granted. Because validation is cryptographic and self-contained, the edge node does not need to query a central database to authorize individual file requests.

URL Design and Validation Flow

A typical signed URL consists of the base asset path and a query string containing metadata and the signature hash. For example:

https://cdn.example.com/videos/tutorial.mp4?exp=1782048000&keyid=v1&sig=a3f89e2c...

The parameters used are:

• exp: An epoch timestamp specifying exactly when the link expires.
• keyid: An identifier indicating which cryptographic key was used to sign the URL, allowing for zero-downtime key rotation.
• sig: The hexadecimal or base64-encoded HMAC-SHA256 signature generated over the request path and parameters.

To generate the signature, the application server creates a signature input string by concatenating the resource path and the expiration parameter. It then signs this string using the secret key:

const signatureInput = `/videos/tutorial.mp4?exp=1782048000`;
const signature = crypto.createHmac('sha256', secretKey).update(signatureInput).digest('hex');

Implementing Edge Signature Verification in TypeScript

Let's look at an implementation of a Cloudflare Worker that validates signed asset URLs at the network edge. Using the Web Crypto API, this worker performs sub-millisecond cryptographic validation, ensuring that only authenticated users can access assets cached in R2 or S3:

interface Env {
  SECRET_SIGNING_KEY: string;
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);
    const path = url.pathname;
    const expParam = url.searchParams.get("exp");
    const sigParam = url.searchParams.get("sig");

    if (!expParam || !sigParam) {
      return new Response("Unauthorized: Missing signature or expiration", { status: 401 });
    }

    // Check expiration timestamp
    const expiration = parseInt(expParam, 10);
    const currentTime = Math.floor(Date.now() / 1000);
    if (currentTime > expiration) {
      return new Response("Unauthorized: URL has expired", { status: 403 });
    }

    // Reconstruct signature input
    const signatureInput = `${path}?exp=${expParam}`;
    const encoder = new TextEncoder();
    const keyData = encoder.encode(env.SECRET_SIGNING_KEY);
    const messageData = encoder.encode(signatureInput);

    // Import crypto key
    const cryptoKey = await crypto.subtle.importKey(
      "raw",
      keyData,
      { name: "HMAC", hash: "SHA-256" },
      false,
      ["verify"]
    );

    // Decode signature
    const signatureBytes = hexToBytes(sigParam);

    // Verify signature
    const isValid = await crypto.subtle.verify(
      "HMAC",
      cryptoKey,
      signatureBytes,
      messageData
    );

    if (!isValid) {
      return new Response("Unauthorized: Invalid signature", { status: 403 });
    }

    // If valid, fetch the asset from storage or cache
    return fetch(`https://storage.internal.example.com${path}`);
  }
};

function hexToBytes(hex: string): Uint8Array {
  const bytes = new Uint8Array(hex.length / 2);
  for (let i = 0; i < hex.length; i += 2) {
    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
  }
  return bytes;
}

This implementation handles the cryptographic verification purely in memory within the V8 isolate. Because the validation runs at the edge, the request is intercepted before any heavy backend resources are spun up, blocking malicious scanners and conserving egress bandwidth.

Best Practices for Asset Protection

To maximize security, developers should set expiration windows as narrow as practical (e.g., 15 minutes for standard video streams). Furthermore, to prevent users from sharing links within their geographic region, you can optionally sign the client's IP subnet or User-Agent string as part of the signature input, ensuring the link is only usable by the device that requested it.

Secure Global Asset Delivery with Bramsley

Implementing and maintaining cryptographic security across distributed edge networks requires absolute precision to protect valuable digital IP without sacrificing performance.

Partner with Bramsley to secure your premium downloads, training videos, and confidential enterprise assets at scale today.