Use your own ESA to connect a Wanxiaozhi website

How it works

Connecting through your own ESA uses the CNAME access method: DNS resolution for your custom access domain name points to Alibaba Cloud ESA. ESA provides edge proxy acceleration and forwards requests to the Wanxiaozhi origin.

A visitor request travels the following path:

1. Visitor request: A visitor accesses your website domain name in a browser, for example, www.example.com.

2. DNS resolution and access: The DNS provider resolves the domain name to the dedicated CNAME address assigned by ESA, and the visitor request reaches an ESA edge node.

3. Edge acceleration and back-to-origin authentication: If the request hits the ESA edge cache, the node returns the content directly to the visitor. If the cache misses, or the request is for dynamic content, ESA follows the configured origin rules and sends a back-to-origin request over HTTPS (port 443) to the origin address provided by Wanxiaozhi. ESA automatically includes the dedicated authentication request header, typically X-WXZ-Origin-Token, to verify the origin identity.

4. Content response: After the Wanxiaozhi origin passes verification, it returns the website content. The ESA edge node responds to the visitor and caches static resources according to the configured policy.

Component responsibilities:

• DNS provider: Resolves your access domain name to your own ESA by using a CNAME record.

• Your own ESA: Receives visitor traffic, provides edge proxy acceleration, sends HTTPS back-to-origin requests according to the rules, and adds the authentication request header to those requests.

• Wanxiaozhi platform: Provides the origin address, the authentication request header name, and the Token credential, and serves as the final origin that hosts and returns the website content.

Prerequisites

Before you connect your own ESA, make sure that the following conditions are met:

• Your Wanxiaozhi application is published and has the entitlement to connect through your own ESA (Wanxiaozhi Premium Edition).

• You have activated ESA, you have the permissions to manage the access domain name and the target ESA site, and the ESA site uses the CNAME access method.

• If the acceleration region includes the Chinese mainland, the access domain name has completed ICP filing as required by ESA.

Billing

• Your own ESA is billed separately according to its plan and billing rules. For details, see Billing.

• Using your own ESA does not mean that all traffic is carried by it. Resources such as assets and files that are accessed through the Wanxiaozhi platform address, and other requests that do not pass through your own ESA may still consume your Wanxiaozhi traffic quota.

• Only Wanxiaozhi Premium Edition supports connecting through your own ESA.

Step 1: Add a domain name and get the origin configuration

1. Log on to the Wanxiaozhi console. After you open the target application, in the left-side navigation pane, choose Deployment > Domain management.

2. Click Bind Domain and select I Have a Domain Name.

3. Enter the domain name (for example, www.example.com). For Access method, select Use your own ESA.

   Note

   • The domain name must not include https://, a port, or a path. Add the root domain and the www subdomain separately.

   • Multiple domain names of the same application can share one origin configuration. Different applications cannot share one.

4. In the Actions column of the domain name list, click Origin configuration, and then copy the origin address, Header name, and the complete Token.

   Adding a domain name only associates it with the application. It does not mean that the ESA connection has taken effect. If the origin configuration is being prepared, wait until it is ready before you continue.

Step 2: Configure the ESA origin and back-to-origin parameters

1. Log on to the ESA console and open the target site.

2. Configure the domain origin: In DNS > Records, add or edit the record for the access domain name.

   Parameter	Configuration
   Record type	CNAME
   Hostname	For example, www; the root domain uses @
   Proxy status	Enable proxy acceleration
   Record value/Origin	Select Domain
   Domain	Enter the origin address provided by Wanxiaozhi Note Enter only the domain name, without the protocol or path. For example, wsxxxxxxxxxxxxxxxxxxxx.origin.wanwang.xin.
   Origin host	Select Follow Origin Domain Name

3. Configure back-to-origin parameters: In Rules > Origin Rules, match the access domain name of the current application and configure the following parameters.

   Parameter	Configuration
   Rule name	Enter a custom name
   Apply to	All incoming requests
   Origin host	Enter the origin address provided by Wanxiaozhi
   Origin protocol	HTTPS
   HTTPS origin port	443
   Origin SNI	Enter the origin address provided by Wanxiaozhi
   Origin certificate verification	Enable

   If you have another Origin host rule, set it to the same Wanxiaozhi origin address so that it does not override the “Follow Origin Domain Name” setting in the DNS record.

   Important

   • For the origin, Origin host, and SNI, use the origin address provided by Wanxiaozhi. Do not enter the access domain name.

   • If the ESA site hosts multiple applications, limit the domain match scope of the rule to avoid affecting other services.

   For complete instructions about DNS records and origin rules, see Manage DNS records and Origin rules.

Step 3: Configure back-to-origin authentication

In Rules > Transform Rules > Modify Request Header, select ESA to origin, create a rule, and match the access domain name of the current application.

Back-to-origin requests must carry the specified Token and override the request header of the same name in the incoming request. Do not configure only “Modify existing request header”, and do not delete or override this header in subsequent rules.

Step 4: Configure web page response headers

If a web page response carries an attachment-download response header, such as Content-Disposition: attachment, the browser downloads the HTML file instead of displaying the page. In this case, configure the following response header rules for the homepage.

1. In Rules > Transform Rules > Modify Response Header, select ESA to client, and then click Create Rule.

2. Apply to: Select Custom rule, and set the match conditions:

   • Hostname: Set to the current access domain name, for example, www.example.com.

   • URI: Set to /.

   • Join the two conditions with AND.

3. Configure the following response header operations.

   Type	Operation	Response header name	Response header value
   Static	Delete	Content-Disposition	Leave blank
   Static	Delete	x-oss-force-download	Leave blank
   Static	Add	Content-Type	text/html; charset=utf-8

4. Save and enable the rule, and make sure that subsequent rules do not override the preceding configuration.

For details about response header transform rules, see Modify outbound response headers.

Step 5: Configure the HTTPS certificate and DNS resolution

1. In ESA, configure a valid HTTPS certificate for the access domain name and complete domain verification. For instructions, see Configure edge certificates.

2. At your DNS provider, resolve the access domain name to the dedicated CNAME address assigned by ESA, not the Wanxiaozhi origin address.

   For details about adding a domain name to ESA, see Add your website to ESA.

3. After the configuration takes effect, verify the connection through the access domain name:

   • The homepage displays correctly and does not trigger an HTML download.

   • Images, JavaScript, and CSS load correctly.

   • Page refreshes, subpaths, and website features work correctly.

   • The browser does not report an HTTPS certificate error.

   Note

   • If you access the Wanxiaozhi origin address directly, the request does not carry a valid Token and may return 403. Verify the connection through the access domain name.

   • (Recommended) For the initial connection, do not cache responses. Configure the cache policy after verification succeeds.

Ongoing management

• Add a domain name: Add the domain name in Wanxiaozhi, and then configure the corresponding DNS resolution, certificate, and origin rules in ESA.

• Update the Token: In Wanxiaozhi, get the Token from Origin configuration for your own ESA, and then update all related ESA origin rules for the current application.

• Remove a domain name: Remove the association in Wanxiaozhi, and then adjust ESA and DNS yourself. Wanxiaozhi does not automatically modify the configurations under your account.

Troubleshooting

In this connection mode, Wanxiaozhi is responsible for website content hosting, access domain name binding, and the platform-side back-to-origin service. You maintain and manage your own ESA configuration, DNS resolution, the domain name SSL certificate, and the ICP filing. If an issue occurs, use the following table to troubleshoot based on the responsible party, or submit a ticket through the corresponding channel: