How do you protect your web server resources? Use signed URLs

Illustration:

Say, you have public URL to access abc.mp4. http://mydomain.com/abc.mp4. And it is made available under pay per download subscription. This is a public URL and anybody can access, but there is a business model around it, which is ‘Pay per download’. This is a revenue leakage if everyone is able to download the asset. How should you make it available for download, but only for one download? You want this URL to be invalid after one usage.

Answer: Use signed URLs.

Signed URLs are usually short lived URLs. Servers are designed to deny access after the expiry of such URLs. It is also possible to specify additional information along with Signed URL, usually will be additional information is determined by the server in focus.

How does it work?

Continuing from the illustration, I define a policy. Policy is nothing but information that your client application will be able to communicate with server application so that server can decide the nature of access to the asset. This can be as simple as a JSON formatted text.

For the illustration, call Client app as C and server app as S. C creates a policy with information, say, ‘Allow_access_to_abc.mp4_18_00_hrs_only_once’. C will hash (creates digest) with SHA-1 algorithm which results in unique digest, say, 123kffsfsfg#$.  C signs the hash generated with the private key and say, the signature generated is ‘uuffaffgfgf’.

Note: Hashing on any given string, results in unique fingerprint, using which you cannot get back the original string. However, the algorithm generates exactly the same unique fingerprint for that string. This way, one can be sure that no one has tampered with information in transit.

Next, C does base64 encoding on the policy, say it results in ‘AB133444CDFDAAABC37122’. After this, C will generate a signed URL, 

http://mydomain.com/abc.mp4?policy= Allow_access_to_abc.mp4_18_00_hrs_only_once&hash=123kffsfsfg#$&signature=uuffaffgfgf

At the server side, S receives the URL, verifies the signature using the public key. S is assured that it is C who signed the hash. Then, S base64 decodes the policy and generates the hash, which in this case will result 123kffsfsfg#$. S matches the generated hash with the hash value sent as parameter in signed URL. Match is positive, S understands that no one has tampered the policy in the transit and interprets the policy and decides the nature of access. S expires the URL after some time and denies repeated unauthorized access.