Access Control

Access Control lets you control who can access live streams by filtering requests by client IP, HTTP Referer, HTTP User-Agent, signed URL token, or a remote authentication server. Rules can be scoped to a directory, file type, or URL pattern, and each rule can use a priority value to determine evaluation order when more than one rule matches a request.

It includes the following controls:

Before You Begin

• For Token Authentication, prepare the signing key, URL parameter names, timestamp format, and signature component order.
• For Remote Authentication, prepare the authentication server URL, expected response status codes, expected response body, timeout policy, and request parameters.

Navigate to Access Control

1. Go to Media Delivery > Media Acceleration Live Broadcast > Configuration.
2. Find the domain that you want to configure, then choose Edit Configuration.
3. In the configuration menu, choose Access Control.
4. The Access Control page shows IP Access List, Referer Access List, User-Agent Access List, Token Authentication, and Remote Authentication.

Configure IP Access List

IP Access List allows or blocks requests based on the client IP address or CIDR block.

1. On the Access Control page, next to IP Access List, choose + Add.
2. In the IP Access List dialog, select an option from Apply to.

3. Enter the scope value.
4. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

5. In Blocked IPs and CIDR Blocks or Allowed IPs and CIDR Blocks, enter IP addresses or CIDR blocks separated by semicolons (;). The field supports up to 65,535 characters, which is about 3,000 IP addresses.
6. In Priority, enter an integer. Rules with a higher value are evaluated first. The default value is 10.
7. Choose Confirm.

Configure Referer Access List

Referer Access List allows or blocks requests based on the HTTP Referer header. Use it to restrict which websites can embed or link to your live streams.

1. On the Access Control page, next to Referer Access List, choose + Add.
2. Select an option from Apply to, then enter the scope value.
3. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

4. Choose the input mode:

   • Domain/URL List: Use fixed domain names or full URLs.
   • Regular Expression: Use patterns or wildcard-style matching.

5. Enter Referer values based on the selected mode.

Domain/URL List mode

Regular Expression mode

6. Set Allow Empty Referer. When this option is enabled, requests without a Referer header are allowed.
7. In Priority, enter an integer. The default value is 10.
8. Choose Confirm.

Configure User-Agent Access List

User-Agent Access List allows or blocks requests based on the HTTP User-Agent header.

1. On the Access Control page, next to User-Agent Access List, choose + Add.
2. Select an option from Apply to, then enter the scope value.
3. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

4. In Blocked User-Agent or Allowed User-Agent, enter User-Agent values, one per line.
5. In Priority, enter an integer. The default value is 10.
6. Choose Confirm.

Configure Token Authentication

Token Authentication requires playback URLs to include a signature and expiry timestamp. The CDN validates the signature and timestamp before allowing access.

1. On the Access Control page, next to Token Authentication, choose + Add.
2. Select an option from Apply to, then enter the scope value.
3. Configure the token parameters.

4. For Signature Components, select the option that matches your playback URL signing logic.

5. Choose Confirm.

Configure Remote Authentication

Remote Authentication forwards request information to your authentication server and allows or denies access based on the server response.

Note: Remote Authentication is not available for HLS origin-pull domains.

1. On the Access Control page, next to Remote Authentication, choose Edit.
2. In the Remote Authentication dialog, set Remote Authentication to On.
3. Under Auth Method, select GET or POST.
4. In Auth Server URL, enter the full authentication endpoint URL, including protocol, host, port if needed, path, and fixed query parameters. Example: https://auth.example.com/api/check?service=live.
5. Optional: In Auth Host, enter a Host header value if the Host header sent to the authentication server must be different from the URL hostname.
6. Under Parameter Retention, select how original URL parameters are forwarded.

7. Under Auth Variables, choose Click for configuration, then select the variables to include in the authentication request. You can also customize the parameter name sent to the authentication server.

8. Under Validation Criteria, select Success or Failure, then configure the response match conditions:
   • HTTP status codes: HTTP status codes returned by the authentication server, separated by semicolons (;).
   • Response body: Response body content returned by the authentication server.
9. In Timeout, enter a value from 1 to 10 seconds. The default value is 5.
10. In Retry Count, enter a value from 0 to 5. The default value is 0.
11. Under Action on Timeout, select the action to take when the authentication server does not respond before the timeout:
    • Allow access: Allow the request when authentication times out.
    • Deny access: Deny the request when authentication times out.
12. Choose Confirm.

Reference

Protocol Support Matrix