Signed URLs and Tokenized Media Delivery: The CDN Layer That Actually Enforces Access
How HMAC-signed URLs and edge tokens protect media segments — signing schemes, expiry design, and the pattern that stops hotlinking without breaking legitimate playback.
DRM protects the video content. Signed URLs protect the delivery — the manifest and segment files themselves. Without them, anyone who grabs your .m3u8 URL can play your streams from anywhere. With them, the URL only works for the session you intended.
How Signing Works
The CDN doesn’t check a password — it verifies a cryptographic signature attached to the URL. Your server signs the media path with a secret only you and the CDN share:
https://cdn.example.com/v/abc123/1080p/index.m3u8
?token=HMAC_SHA256(path + expiry + session_id, SECRET)
&exp=1727280000
At the edge, the CDN recomputes the signature over the URL’s path + expiry and compares. Match → serve. Mismatch → 403. No round-trip to your server, no database lookup — the whole check happens in a few microseconds at the PoP.
The Design Choices That Matter
| Parameter | Safe Default | Why |
|---|---|---|
| Expiry window | 4–8 hours | Long enough for a session; short enough to rot a leaked link |
| Token scope | Path prefix (/v/abc123/*), not a single file | One token per session, not per segment |
| Algorithm | HMAC-SHA256 | Fast, symmetric, secure |
| IP binding | Optional — never required | IPs change on mobile; bind to session ID instead |
Why You Sign the Manifest, Not the Segments
Segments are immutable and cacheable — sign the manifest once, and the CDN serves the segment files it references without re-verifying each one. Trying to sign every segment individually multiplies your signing load for no security gain.
The Hotlinking Problem
The threat signed URLs solve is hotlinking: a pirate site embedding your media URLs directly, letting their users watch your content on your bandwidth. Unsigned media URLs leak trivially. Signed ones expire — by the time the pirate mirrors the link, it’s already dead.
// Edge worker — verify HMAC token, no backend hit
const valid = await verifyHmac(
`${pathname}|${expiry}|${sessionId}`,
signature,
SECRET
);
if (!valid || Date.now()/1000 > expiry) return new Response('Forbidden', { status: 403 });
“Signed URLs don’t prevent piracy — they prevent freeloading. The goal isn’t to make copying impossible; it’s to make the pirate do the work of re-uploading instead of hotlinking your CDN.”
Signing recipes for Cloudflare, Fastly, and edge workers — plus the rotation scheme that keeps secrets fresh — are in the signed URL and tokenized delivery guide.