Access Control

Access Control restricts access to live streams by client IP address, HTTP Referer, HTTP User-Agent, URL signature, or the result returned by your authentication server. For rule-based controls, use a directory, file type, or URL pattern to define the scope and a priority value to set the evaluation order.

Available controls depend on the domain role and stream ingest mode. Ingest domains provide IP Access Control, Token Authentication, and Remote Authentication; Referer and User-Agent controls apply to delivery domains.

Note: When using Referer or User-Agent access control, we recommend disabling RTMP in Delivery Protocols. RTMP does not support these header-based controls.

Before You Begin

• For Token Authentication, prepare the signing key, URL parameter names, timestamp format, and signature component order.
• For Remote Authentication, prepare the authentication endpoint, response conditions, timeout policy, and request parameters.

Navigate to Access Control

1. Go to Media Delivery > Media Acceleration Live Broadcast > Configuration.
2. Find the domain that you want to configure, then choose Edit Configuration.
3. In the configuration menu, choose Access Control.

Configure IP Access Control

IP Access Control allows or blocks requests by client IP address. Use CIDR notation to specify an address range.

1. On the Access Control page, next to IP Access Control, choose Add.
2. In the IP Access Control dialog, select an option from Rule Scope.

3. Enter the scope value.
4. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

5. In Blocked IPs and CIDR Blocks or Allowed IPs and CIDR Blocks, enter IP addresses or CIDR blocks separated by semicolons (;). The field supports up to 65,535 characters, or about 3,000 IP addresses. You can also choose Import TXT to import entries from a text file.
6. In Priority, enter an integer. Rules with a higher value are evaluated first. The default value is 10.
7. Choose Confirm.

Configure Referer Access Control

Referer Access Control allows or blocks requests based on the HTTP Referer header. Use it to restrict which websites can embed or link to your live streams.

1. On the Access Control page, next to Referer Access Control, choose Add.
2. Select an option from Rule Scope, then enter the scope value.
3. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

4. Set Use Regular Expression:

   • Leave it off to enter domain names or full URLs.
   • Turn it on to match Referer values with regular expressions.

5. Enter Referer values based on the selected mode.

Domain names and full URLs

Regular expressions

Enter one regular expression per line, for example, ^https?://www\.example\.com/.*.

6. Set Allow Empty Referer. When this option is enabled, requests without a Referer header are allowed.
7. In Priority, enter an integer. The default value is 10.
8. Choose Confirm.

Configure User-Agent Access Control

User-Agent Access Control allows or blocks requests based on the HTTP User-Agent header.

1. On the Access Control page, next to User-Agent Access Control, choose Add.
2. Select an option from Rule Scope, then enter the scope value.
3. Under Rule Type, select Blocklist or Allowlist.

Important: Only one allowlist rule is supported. If you need to allow multiple entries, add all entries to the same allowlist rule.

4. In Blocked User-Agent or Allowed User-Agent, enter User-Agent values, one per line.
5. In Priority, enter an integer. The default value is 10.
6. Choose Confirm.

Configure Token Authentication

Token Authentication validates the signature and timestamp in the request URL before allowing access. Configure the same parameter names, key, timestamp format, and component order in your URL signing logic.

1. On the Access Control page, next to Token Authentication, choose Add.
2. Select an option from Rule Scope, then enter the scope value.
3. Configure the token parameters.

4. For Signature Input Order, select the option that matches your request URL signing logic.

5. Choose Confirm.

Configure Remote Authentication

Remote Authentication validates stream ingest and delivery requests. The CDN forwards request parameters to your authentication server and allows or denies access based on its response.

Note: Remote Authentication is not available for HLS origin-pull domains.

1. On the Access Control page, next to Remote Authentication, choose Edit.
2. In the Origin Authentication dialog, set Remote Authentication to On.
3. Under Request Method, select GET or POST.
4. In Authentication Server URL, enter the full authentication endpoint URL, including protocol, host, port if needed, path, and fixed query parameters. Example: https://auth.example.com/api/check?service=live.
5. Optional: In Authentication Request Host, enter a Host header value if the Host header sent to the authentication server must be different from the URL hostname.
6. Under Query Parameter Forwarding, select how original URL parameters are forwarded.

7. Under Authentication Request Parameters, choose Click for configuration, then select the variables to include in the authentication request. Customize their parameter names to match your authentication server.

8. Under Authentication Result Criteria, select Success or Failure, then configure the response match conditions:
   • HTTP status codes: HTTP status codes returned by the authentication server, separated by semicolons (;).
   • Response body: Response body content returned by the authentication server.
9. In Authentication Timeout, enter a value from 1 to 10 seconds. The default value is 5.
10. In Authentication Retry Count, enter a value from 0 to 5. The default value is 0.
11. Under Action on Timeout, select the action to take when the authentication server does not respond before the timeout:
    • Allow Access: Allow the request when authentication times out.
    • Deny Access: Deny the request when authentication times out.
12. Choose Confirm.

Save and submit changes

After confirming a rule or changing a switch, review the configuration. Save Draft saves your work as a draft. To continue through review and submission, choose Next and follow the console prompts. Before testing, check the domain’s configuration status and confirm that the changes have taken effect.

Reference

Protocol Support

Remote Authentication also requires a supported domain type, as described above.