Resolve DCDN cache misses from token authentication-Web Application Firewall(WAF)-阿里云帮助中心

Resolve cache misses that occur when WAF token authentication inserts random parameters into request URLs. Configure a custom cache key that ignores these parameters to keep caching effective and reduce the back-to-origin rate.

Background information

If you use DCDN with cache rules and enable WAF token authentication, WAF inserts random parameters into request URLs during authentication. These parameters prevent requests from matching DCDN cache rules, so requests go directly to the origin server. This increases the load and pressure on the origin server, degrades performance, and extends response time. To resolve this issue, configure a custom cache key that ignores these parameters. This keeps DCDN caching effective and reduces the back-to-origin rate.

Prerequisites

DCDN is activated and dynamic and static acceleration rules are configured. For more information, see Activate DCDN and Dynamic and static content acceleration rules.
Bot management is activated and advanced bot mitigation (dynamic token challenge) is enabled. For more information, see Enable bot management and Create a scenario-based protection template.

Solution overview

This topic uses DCDN as an example. If you use Content Delivery Network (CDN), the configuration method is the same.

You can configure a custom cache key in two steps:

Configure a custom cache key: Ignore the random parameters inserted into URLs. This improves the cache hit rate, reduces the back-to-origin rate, and lowers response time and bandwidth consumption.
Test and verify: Confirm that the configuration works as expected.

Step 1: Configure a custom cache key

Get the token parameter name

Before you configure a custom cache key, access the target website in a browser to trigger token authentication and get the token parameter name. The following example shows a request URL that contains a token parameter:

https://xxx/xxxdc.html?md5__1524=eqRxuD9iDtKCqAKD%3DD%2FD0i5twcbDRiYPx6moD

The token parameter name is randomly generated for each domain name. However, all requests under the same domain name use a fixed token parameter name. The name follows the format XXX__random number, where XXX can be one of the following words: timestamp, md5, type, ipcity, decode, encode, time, or refer.

Set the parameter action in the console

In the custom cache key configuration, you can modify the URI, request parameters, and HTTP headers. You can also use custom variables to extract required fields from requests. The final cache key consists of four parts: the URI, request parameters, HTTP headers, and custom variables.

Log on to the DCDN console. In the left-side navigation pane, click Domain Names. Find the target domain name, and in the Actions column, click Configure.
In the left-side navigation pane of the specified domain name, click Caching, select the Custom Cache Keys tab, and click Configure.
In the Custom Cache Key dialog box, set Parameter Actions to Delete and enter the token parameter name that you got earlier. For more information about other configurations, see Custom cache key parameter description.

Step 2: Test and verify

Test the configuration thoroughly. Make sure that the cache policy, WAF token authentication, and the custom cache key are correct and work as expected.

Open the browser developer tools and access the website. Click Network and view the response headers. If the X-Cache header is present and its value contains the HIT keyword, the configuration works and the cache is hit.

The X-Cache header indicates whether the cache is hit: HIT means the cache is hit, and MISS means the cache is missed.

The following example shows the response headers of a request that hits the cache:

Response Headers
Accept-Ranges:              bytes
Age:                        7
Ali-Swift-Global-Savetime:  1730188630
Connection:                 keep-alive
Content-Length:             14
Content-Type:               text/html; charset=UTF-8
Date:                       Tue, 29 Oct 2024 07:57:10 GMT
Eagleid:                    7521a19d17301886372938421e
Etag:                       "e-625470f0c1bb7"
Last-Modified:              Fri, 25 Oct 2024 06:16:25 GMT
Server:                     Tengine
Timing-Allow-Origin:        *
Via:                        cache19.l2cn3137[58,57,200-0,M], cache11.l2cn3137[60,0], kunlun4.cn7737[0,0,200-0,H], kunlun9.cn7737[1,0]
X-Cache:                    HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-Cachetime:          86400
X-Swift-Savetime:           Tue, 29 Oct 2024 07:57:10 GMT