Secure HLS on CDNsun
HLS (HTTP Live Streaming) is easy to deliver at scale, but it is also easy to steal: a single leaked .m3u8 can be shared, embedded elsewhere, or used for unauthorized restreaming. Because HLS is built from playlists and many small segments, protecting only one URL is rarely enough. This article explains how to secure HLS on CDNsun using URL signing and complementary controls like hotlinking, geo-blocking, IP rules, and password protection.
URL signing for HLS on CDNsun: token protection that fits playlists and segments
What problem URL signing actually solves
URL signing (token authentication) prevents direct link sharing and bandwidth theft by requiring each request to include a valid cryptographic token and an expiration time. Even if someone copies the playback URL, it will stop working when the token expires. This is especially important for premium live streams and VOD content distributed at high scale, where “security by obscurity” (unguessable URLs) fails quickly once links are posted publicly.
Why HLS needs a specific approach
HLS is not one file. A typical stream includes:
- Master playlist (often master.m3u8) referencing variants (bitrates, resolutions).
- Variant playlist(s) (e.g., index_3000.m3u8) referencing the media segments.
- Segments (.ts or .m4s) requested continuously during playback.
- Optional assets like keys (.key) for encryption or captions.
If you sign only the playlist URL but segments are accessible without the same protection, an attacker can fetch segments directly once they learn the path pattern. CDNsun addresses this by supporting URL signing in a way that matches HLS delivery: instead of signing a single file, you sign the directory path that contains the HLS playlists and segments. That way, every request under that path requires a valid token.
Recommended structure for secure HLS paths
To make path-based signing clean and predictable, keep each stream under its own folder, for example:
- /hls/event-123/ (master playlist, variants, segments)
- /hls/event-123/master.m3u8
- /hls/event-123/index_3000.m3u8
- /hls/event-123/seg_00001.ts
This design makes it easy to generate one token that protects everything the player needs to request.
How the signed HLS URL looks
With CDNsun, the signed URL includes the token and expiration and is applied to the path so that all files within it are protected. Conceptually, it looks like:
- https://cdn.example.com/secure=TOKEN&expires=TIMESTAMP/hls/event-123/master.m3u8
Generate tokens using CDNsun’s Python function
CDNsun provides a Python URL signing function you can integrate into your backend so your application issues short-lived playback URLs only to authorized viewers. Using the provided script, you sign the directory path (note the trailing slash):
Example (Python CLI):
python UrlSigning.py -s ‘https’ -r ‘cdn.example.com’ -p ‘/hls/event-123/’ -k ‘YourSecretKey’ -e 1738944000
Operational best practices for URL signing
- Keep expirations short for live streams: minutes, not hours. Short TTLs limit the value of leaked links.
- Issue tokens server-side only: never expose the signing key to the browser, mobile app bundle, or player-side JavaScript.
- Rotate keys safely: maintain a process to rotate the secret key periodically, and do it before major events.
- Bind tokens to delivery structure: sign a folder dedicated to one stream/event to avoid unintentionally granting access to neighboring content.
- Plan for player behavior: HLS players may open parallel connections and prefetch segments, so avoid ultra-short TTLs that can expire mid-playback unless your workflow refreshes URLs.
Layered access control on CDNsun: hotlinking, geo/IP rules, and password protection
Why layering matters
URL signing is strong against link sharing, but real-world abuse often combines multiple vectors: embedding your player on another domain, distributing access from restricted regions, or pulling streams from known “restreaming” IP ranges. CDNsun’s additional controls reduce risk further by adding independent checks at the edge. When combined, these features create defense in depth: if one control is bypassed or misconfigured, another still blocks unauthorized access.
Hotlinking policy (Referer-based protection)
Hotlinking happens when someone embeds your HLS URL on their website or copies your player integration, consuming your bandwidth and sometimes your audience. With a hotlinking policy, CDNsun checks the Referer header and allows requests only from approved domains.
- Use case: play HLS only when embedded on https://www.yoursite.com.
- Typical configuration: set policy to Block by default and add allowed domains.
- Important detail: Referer is helpful but not perfect because some environments strip it (privacy tools, certain apps). For high-value streams, use hotlinking as a layer on top of URL signing, not as the sole protection.
Country access policy (geo-blocking / geo-allow)
Licensing terms often require you to restrict playback to specific countries. CDNsun’s country access policy enforces this at the edge based on the viewer’s IP geolocation.
- Use case: allow streaming only in the UK and Ireland.
- Typical configuration: Block by default and add permitted countries, or Allow by default and blacklist restricted regions.
- Practical advice: for rights-managed content, allowlisting is usually safer than blocklisting. Also expect some edge cases (VPNs, mobile carrier IP allocations).
IP access policy (network-level allow/deny)
IP access policy is ideal for internal streams, partner-only previews, staging environments, or securing origin pull endpoints. It restricts requests to a defined set of IPs or ranges.
- Use case: a private corporate broadcast accessible only from office IPs or a VPN egress range.
- Typical configuration: Block by default and add office public IPs (or CIDR ranges).
- Gotcha: if your users are on consumer ISPs or mobile networks, IPs can change frequently. IP allowlists work best when viewers come from stable networks.
Password protection (HTTP Basic Auth)
Password protection adds a straightforward gate using HTTP Basic Authentication. It is useful when you need quick, human-scale access control without building a full entitlement system.
- Use case: sharing a pre-release stream with a small test group or client reviewers.
- Behavior: the player or browser must send credentials to fetch the playlist and segments.
- Security note: always use HTTPS. Basic Auth is not a replacement for URL signing at scale because credentials can be shared, but it is effective for limited distribution and staging.
Recommended secure presets
- Premium live event: URL signing (short expiry) + hotlinking allowlist + country allowlist.
- Internal stream: IP allowlist + URL signing (optional) for extra safety.
- Client review link: password protection + URL signing to reduce forwarding and link persistence.
When implementing layered controls, start with URL signing for the HLS folder path, then add policies that match your business constraints (where users are, where your player is embedded, and who should have access). This keeps the HLS workflow reliable while blocking the most common abuse patterns.
Conclusion
Securing HLS requires protecting more than a single playlist URL, because every playback session pulls many segments and related files. On CDNsun, URL signing designed for HLS lets you sign the stream directory so playlists and segments are consistently protected with time-limited tokens. Adding hotlinking rules, country restrictions, IP policies, and password protection creates a layered defense that prevents embedding, regional violations, and unauthorized access. Combine the right layers for your stream’s value and audience.