Access control FAQ
Answers to common questions about restricting access to DCDN resources, including IP blacklists and whitelists, URL signing, and remote authentication.
When I configure an IP address blacklist or whitelist, the number of IP addresses is limited. Is a CIDR block considered one IP address or multiple IP addresses?
Dynamic Content Delivery Network (DCDN) allows you to add up to about 700 IPv6 addresses and 2,000 IPv4 addresses to an IP address blacklist or whitelist.
A CIDR block is considered one IP address.
Why can I still use an IP address in the IP address blacklist to request resources?
DCDN cannot restrict clients from initiating requests. After you configure an IP address blacklist, DCDN returns the HTTP 403 status code for requests from IP addresses in the blacklist and records the requests in DCDN logs. For information about how to view logs, see Quick start.
How do I get the originating IP address of a client?
Retrieve it from the X-Forwarded-For header. For details, see Retrieve the originating IP addresses of clients.
I need to add the DCDN POP IP addresses to the whitelist on my origin server. Can Alibaba Cloud provide the IP addresses of the DCDN POPs that access the origin server?
If you have previously applied for and obtained the permission to call the DescribeDcdnL2Ips API operation (under the DCDN Origin Protection - back-to-origin convergence feature), you can use it to retrieve the IP address ranges of the back-to-origin nodes for a specific domain name. Note that when back-to-origin convergence is enabled, reducing the number of back-to-origin IP address ranges means that the number of back-to-origin points of presence (POPs) is also reduced. This may negatively impact your access quality. Enable this feature with caution.
A URL signing failure leads to access to DCDN accelerated resources returning a 403 error?
URL signing prevents unauthorized access to your origin resources. If URL signing is enabled for Alibaba Cloud DCDN and you receive a 403 error when accessing DCDN-accelerated resources, check the error message in the Response Header by using browser developer tools. Common error messages:
Error message: X-Tengine-Error:denied by req auth: no url arg auth_key
Cause: URL signing is enabled for DCDN, but the request URL does not contain the required authentication parameter.
Solution: If you want to use the DCDN URL signing feature, configure it by following the instructions in Configure URL signing. If you do not need the DCDN URL signing feature, log on to the DCDN console and disable it.
Error message: X-Tengine-Error: denied by req auth: expired timestamp
Cause: URL signing is enabled for DCDN, but the timestamp in the authentication parameter has expired.
Solution: If the signed URL has expired, generate a new one. For more information, see Configure URL signing.
Error message: X-Tengine-Error: denied by req auth: invalid md5hash
Cause: The MD5 hash in the authentication parameter is incorrect.
Solution: You can use the URL generator in the DCDN console to generate a URL and compare it with your signing code. You can also refer to Signing code examples.
Can I enable DCDN URL signing and remote authentication at the same time?
Yes, you can. If both features are enabled, requests are first processed by URL signing and then by remote authentication.
Can I use a private network address for the remote authentication server?
No, you cannot. The remote authentication server must have a public network address.
If the authentication server returns a status code that is neither a success nor a failure code, why does DCDN grant access?
To prevent unexpected responses from blocking user requests, DCDN grants access by default when the authentication server returns a status code not defined as a success or failure code. For example, if the success code is 200 and the server returns 201, the request is granted.
In the console, you can configure the Allow Other Status Codes parameter to control whether to grant access for other status codes returned by the authentication server.
If the remote authentication server has a fault or is down, does DCDN grant access to all requests?
No. If the remote authentication server is unavailable, the connection between DCDN and the authentication server times out. DCDN then handles requests based on the Action on Timeout parameter.