Cookie Access Rules
Last update：2026-04-13 18:28:45
Cookies are data stored on a user’s local device by certain websites to identify user identity and perform session tracking. When a user revisits the same website, the original cookie is carried to the server. Therefore, access control can be performed based on this header. When a CDN edge server receives a client request, it checks the information in the Cookie field of the HTTP request header, and then allows or denies user requests that comply with specific rules.
How to Set Up the Cookie Access Rule
- Log in to the CDNetworks Console and select the appropriate product.
- Go to the Configuration, locate the domain you wish to configure, and click Edit Configuration
. - Navigate to Access Control - Cookie Access List in the left sidebar and click Add.
- Configure the settings as follows based on your needs.
Apply to
This defines the range of requests that Cookie rules will apply to. You can choose from the following options:
| Setting | Description |
|---|---|
| All Requests | The access control rule applies to all types of requests. |
| Only Homepage | Applies only to the root directory of the domain, such as http://domain/ or https://domain/. |
| Specific File Type | Applies only to specific types of files. You can select from the predefined file types on the left or define custom file types. Separate multiple custom types with a semicolon ; (e.g., jpg;png). |
| Specific URL Path | Applies only to requests for content at a specific URL path. Two URL path matching options are available:Full URL Path: Complete URL path, including parameters (e.g., path/index.html?abc=123). Ignore Query String: URL path without query parameters (e.g., path/index.html). |
| Specific Directory | Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*.Note: Directories must start and end with /, and can only contain letters, numbers, and certain special characters (underscore, hyphen, percent sign, dot). Multiple directories are supposed to be separated with line breaks. |
| URL Pattern (Regex) | Uses regular expressions to control the scope for the requests that the rules will be applied to. For example, the pattern *.jpg$ ensures that access control applies to all URLs ending with .jpg. |
Advanced Scope Conditions
You can further refine the rule’s scope using Advanced Scope Conditions. This will intersect with the basic Apply to for precise control. Select one or more parameters to form an AND relationship with the basic rules to target specific requests or responses.
| Parameter | Description |
|---|---|
| Region or Exclude Regions | Supports direct search selection from the list of countries/regions provided by CDNetworks; For Mainland China, it is possible to select specific provinces or larger geographical areas, such as East Region and Southwest Region. |
| Exclude File Type | Excludes certain file types. Separate multiple types with ;. |
| Exclude Custom File Type | Excludes custom file types as needed. Separate multiple types with ;. |
| Exclude Directory | Excludes specific directory paths. Paths must start and end with /. Separate multiple directories with ;. |
| Exception URL (Regex) | Excludes URLs using regex, e.g., .*\.jpg$. |
| Access-Control-Allow Methods | Matches HTTP request methods. Separate multiple methods with ;, e.g., GET;POST. |
| Exclude Request Method | Excludes specific HTTP request methods. |
Rule Type
You can configure either a Cookie Blocklist or Allowlist:
| Type | Description |
|---|---|
| Blocklist | Access denied if the request’s cookies contain certain content. |
| Allowlist | Allows access only if the request’s cookies contain certain content. |
Tips
- You should use regular expressions to configure blocklists or allowlists. For example, the expression
GOOGLE=70238C3Ematches all requests that containGOOGLE=70238C3Ein their cookies.- The system supports only one allowlist rule. If multiple cookie rules are needed, they must all be included within this single allowlist.
Action
When the Cookie does not meet the set rules, and a request is denied by the CDN, choose whether to return an error code directly or redirect to another URL:
- Block Access: The CDN rejects the request with a 403 error.
- Redirect: The CDN redirects the requests to another URL.
Allow Empty Cookie
Whether to allow access for requests with empty cookies, even if an allowlist already exists. The default value is disabled.
- If enabled, requests without Cookie header are allowed to access;
- If disabled, requests without Cookie header will be blocked with a
403error.
Case-Insensitive Match
The default for this setting is Yes.
- The Yes option indicates that the Apply to will be case-insensitive. Requests that differ only in letter case will still match. For example, if you set the scope to
http://domain/a.jpg, bothhttp://domain/a.jpgandhttp://domain/A.jpgwill trigger the rule. - Conversely, if you choose No, the rule will only apply to incoming requests that exactly match the capitalization specified in your Apply to settings.
Priority
When multiple access control rules are configured, the CDN prioritizes them based on their numerical value, executing higher numbers first.
After you have completed setting the configurations, please click OK and then select Next to submit your settings. To minimize any potential disruptions to your production environment, we strongly recommend conducting a Pre-deploy test in a staging environment. This crucial step ensures that your configurations are accurate before they go live. Once you have verified the accuracy of the settings, click Deploy Now to implement them in the live environment. The configurations typically become effective within 3-5 minutes. For comprehensive guidance on pre-deployment testing and to verify the effectiveness of your configurations, please consult the tutorial Deploy the Configurations to Staging Environment for Validation.
Best Practices
Example 1: Configure a Cookie Blocklist
Access will be denied for all requests whose cookies contain aaa.
Example 2: Configure a Cookie Allowlist
For all requests, access is permitted only if the request’s cookies contain aaa or bbb.
Notes
Please DO NOT configure both Cookie blocklists and allowlists simultaneously, as this may result in all CDN access being denied, potentially disrupting your online operations. For instance, configuring both a Cookie blocklist and allowlist as shown below can lead to all access being denied.
Why would all access be denied?
- When a request carries the Cookie value
aaa, it matches the Cookie blocklist rule, and the CDN denies access. - Requests without the Cookie value
aaa, while not denied by the blocklist, fail to meet the allowlist (which only allows access for requests with the Cookie containingaaa) and are also denied.
If you need to configure both a blocklist and an allowlist, please contact our technical support for assistance to ensure proper setup.