Signed URLs for Video: CDN Access, Expiry & DRM Limits | Callaba

A signed URL lets an edge or origin verify that one HTTP request matches an authorized resource and policy, usually including an expiry. It can reduce casual sharing and origin exposure, but it does not encrypt the video, control a browser's decoder or become DRM. For adaptive streaming, the policy must also cover the child playlists, segments, keys and retries a player actually requests.

A signed URL is an HTTP authorization decision

Define the signed policy before choosing parameters

A signing input normally covers a resource or path, expiry, key identifier and optional restrictions such as start time or client network. The exact canonical string and signature algorithm are provider-specific. Amazon CloudFront signed URLs, for example, validate a canned or custom policy and can restrict expiry, start time and IP range depending on the policy type.

Write the policy down before implementing it: which user can access which asset, whether variants share a path, how long playback and retries may continue, and what happens after logout or entitlement revocation. Never put a master signing key in the browser. The backend should authorize the account, build the exact policy and return only the viewer credential.

Sign the HLS or DASH request graph

An adaptive player first requests a top-level manifest, then child playlists or MPD references, initialization objects, media segments, subtitles and possibly keys. A token embedded only in the root query may disappear when relative child URLs are resolved or may not authorize a different hostname. Enumerate the graph under each packaging configuration.

Use a provider mechanism that fits many related objects: a path-scoped signed token, a signed cookie, manifest URL rewriting or another documented policy. Keep the cache key strategy deliberate. If a unique signature becomes part of the cache key, identical media can fragment into per-viewer cache entries; if signature parameters are excluded, the edge must still validate them before serving a cache hit.

Expiry must survive playback and retry behavior

The edge evaluates expiry on HTTP requests. A live player continues making new segment requests, so a token that expires during the session can cause a sequence of 403 responses even though the manifest was accepted earlier. CloudFront notes that each later range or retry request is checked at its own request time.

Set lifetime from actual playback behavior, clock skew, pause, seeking and reconnect requirements. Google Media CDN recommends a future timestamp at least one minute away or at least the stream duration, whichever is greater, for its signed-request model. That is provider guidance, not a universal value. Renew safely before expiry when long sessions require it, and test renewal without exposing a master credential.

Protect the origin as well as the CDN route

A perfect edge policy is bypassed if viewers can address a public origin directly. Restrict origin access to the CDN using the provider's supported identity, private network or origin authentication pattern. If the origin must validate a signature too, specify whether the CDN forwards the viewer token or uses a separate edge-to-origin credential.

Deny an unsigned request at both the public CDN hostname and the origin hostname during acceptance testing. Avoid relying on an obscure origin URL as protection. Monitor origin traffic for unexpected user agents, direct requests and authorization failures.

Rotate signing keys without interrupting viewers

Use named keys and a staged rotation: add the new verification key, begin issuing new signatures, wait for old credentials to expire, then remove the previous key. Maintain an emergency revocation path for a compromised signer. Separate signing permission from CDN configuration permission.

Log key ID, policy scope, issue time, expiry, decision and asset—not the private key or a reusable full URL. Limit log retention because signed URLs can remain bearer credentials until they expire.

A signed URL is not DRM

Signed delivery controls whether an HTTP request may retrieve an object. Once an authorized client receives clear media, the URL signature does not govern decoding or copying. It also does not create device security, output protection, offline-license policy or a content-decryption module.

W3C Encrypted Media Extensions defines browser APIs that interact with key systems and license/key exchange for encrypted content; the specification explicitly does not itself define one DRM system. A production DRM stack packages encrypted media and enforces key-system-specific license policy. Signed URLs and DRM can be combined, but neither substitutes for the other.

Plan for sharing, replay and revocation

A signed URL is usually a bearer credential: anyone who obtains it can use it while it remains valid and within its policy. Keep scope and lifetime narrow, use HTTPS, prevent referrer and analytics leakage where possible, and avoid placing long-lived tokens in support screenshots.

Immediate per-user revocation is difficult while a self-contained URL remains valid at distributed edges. Short lifetimes, session-bound token exchange or an online entitlement check reduce that window, but they add control-plane traffic. Treat that as an explicit tradeoff; signatures do not stop redistribution.

Use a signed-delivery acceptance test

1. Map objects. List every hostname and resource requested during start, adaptation, seek and retry.
2. Test policy. Accept the entitled asset and deny another asset, an altered path, expired token and wrong key ID.
3. Test playback lifetime. Run through pause, long viewing, token renewal and post-expiry retries.
4. Test caching. Confirm validation occurs for hits and misses without destroying cache efficiency.
5. Test the origin. Prove direct unsigned origin access is unavailable.
6. Test rotation. Overlap old and new verification keys, then retire the old key after its tokens expire.
7. Test DRM separately. When required, deny a missing or invalid license even if CDN authorization succeeds.