Cookie Access Rules
Last update：2025-04-24 11:35:53
Cookies are data stored on a user’s local device by certain websites to identify user identity and perform session tracking. When a user revisits the same website, the original cookie is carried to the server. Therefore, access control can be performed based on this header. When a CDN edge server receives a client request, it checks the information in the Cookie field of the HTTP request header, and then allows or denies user requests that comply with specific rules.
How to Set Up the Cookie Access Rule
- Log in to the CDNetworks Console and select the appropriate product.
- Go to the Configuration, locate the domain you wish to configure, and click Edit Configuration
. - Navigate to Hotlink Protection - Cookie Anti-hotlinking in the left sidebar and click Add.
- Configure the settings as follows based on your needs.
Effective Range
This defines the range of requests that Cookie rules will apply to. You can choose from the following options:
| Setting | Description |
|---|---|
| All Requests | The access control rule applies to all types of requests. |
| Only Homepage | Applies only to the root directory of the domain, such as http://domain/ or https://domain/. |
| Specified File Type | Applies only to specific types of files. You can select from the predefined file types on the left or define custom file types. Separate multiple custom types with a semicolon ;.(e.g., jpg;png). |
| Specified URI | Applies only to requests for content at a specific URI. Two URI matching options are available:Exact matching: Complete URI, including parameters.(e.g., path/index.html?abc=123). Ignore the parameter matching: URI without query parameters.(e.g., path/index.html). |
| Specified Directory | Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*.Note: Directories must start and end with /, and can only contain letters, numbers, and certain special characters (underscore, hyphen, percent sign, dot). Multiple directories are supposed to be seperated with line breaks. |
| URL Pattern | Uses regular expressions to control the range of requests that the rules will be applied to. For example, the pattern *.jpg$ ensures that access control applies to all URLs ending with .jpg. |
Advanced Range Settings
As shown above, you can further refine the rule’s effective range using Advanced Range Settings. This will intersect with the basic effective range for precise control. Select one or more parameters to form an AND relationship with the basic effective range to target specific requests or responses.
| Parameter | Description |
|---|---|
| Region or Exception Region | Supports direct search selection from the list of countries/regions provided by CDNetworks; For Mainland China, it is possible to select specific provinces or larger geographical areas, such as East China, Southwest China. |
| Exception File Types | Excludes certain file types. Separate multiple types with ;. |
| Exceptional Custom File Types | Excludes custom file types as needed. Separate multiple types with ;. |
| Exception Directory | Excludes specific directory paths. Paths must start and end with /. Separate multiple directories with ;. |
| Exception URL (Regex) | Excludes URLs using regex, e.g., .*\.jpg$. |
| Request Method | Matches HTTP request methods. Separate multiple methods with ;, e.g., GET;POST. |
| Exception Request Method | Excludes specific HTTP request methods. |
Cookie Type
You can configure either a Cookie blacklist or whitelist:
| Type | Description |
|---|---|
| Cookie Blacklist | Access denied if the request’s cookies contain certain content. |
| Cookie Whitelist | Allows access only if the request’s cookies contain certain content. |
Tips
You should use regular expressions to configure blacklists or whitelists. For example, the expressionGOOGLE=70238C3Ematches all requests that containGOOGLE=70238C3Ein their cookies.
The system supports only one whitelist rule. If multiple cookie rules are needed, they must all be included within this single whitelist.
Action
When the Cookie does not meet the set rules, and a request is denied by the CDN, choose whether to return an error code directly or redirect to another URL:
- Deny Access: The CDN rejects the request with a 403 error.
- Redirect URL: The CDN redirects the requests to another URL.
Allow NULL Cookie
Whether to allow access for requests with empty cookies, even if a whitelist already exists.
Priority
When multiple access control rules are configured, the CDN prioritizes them based on their numerical value, executing higher numbers first.
After you have completed setting the configurations, please click OK and then select Next to submit your settings. To minimize any potential disruptions to your production environment, we strongly recommend conducting a Pre-deploy test in a staging environment. This crucial step ensures that your configurations are accurate before they go live. Once you have verified the accuracy of the settings, click Deploy Now to implement them in the live environment. The configurations typically become effective within 3-5 minutes. For comprehensive guidance on pre-deployment testing and to verify the effectiveness of your configurations, please consult the tutorial Deploy the Configurations to Staging Environment for Validation.
Best Practices
Example 1: Configure a Cookie Blacklist
Access will be denied for all requests whose cookies contain aaa.
Another case, the access will be denied for all requests whose cookies contain bbb or ccc.
Example 2: Configure a Cookie Whitelist
For all requests, access is permitted only if the request’s cookies contain aaa or bbb.
Notes
Please DO NOT configure both Cookie blacklists and whitelists simultaneously, as this may result in all CDN access being denied, potentially disrupting your online operations. For instance, configuring both a Cookie blacklist and whitelist as shown below can lead to all access being denied.
Why would all access be denied?
- When a request carries the Cookie value
aaa, it matches the Cookie blacklist rule, and the CDN denies access. - Requests without the Cookie value
aaa, while not denied by the blacklist, fail to meet the whitelist (which only allows access for requests with the Cookie containingaaa) and are also denied.
If you need to configure both a blacklist and a whitelist, please contact our technical support for assistance to ensure proper setup.