How to Install the Secure Token Integration

Azion Secure Token is a customizable integration that provides time-limited URLs with token-based authentication, commonly used to secure video assets for live streaming and on-demand content.

View as Markdown

Azion Secure Token is a serverless integration available at Azion Marketplace.

With the help of the Azion Secure Token integration, you can make token-based, time-limited URLs. The creation and validation of signatures for cookies, authentication headers, and other security measures can be done using these tokens, which can be altered in a variety of ways. Utilizing both HLS and Progressive Download, the solution is frequently used to secure video assets, including those used for live streaming and on-demand content.

Getting the integration

To use the Secure Token integration provided by Azion Marketplace, you have to:

  1. Access Azion Console > Marketplace.
  2. On the Marketplace homepage, select Secure Token card.
  3. Once the integration’s page opens, click the Install button.

You’ll see a message indicating that your integration was successfully installed.

You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.

Generating the token

In order to use this integration, you’ll have to generate a token. To do so, follow these steps:

  1. Go to the Azion’s Secure Token GitHub repository.
    • In this repository, you’ll find a brief explanation about how the Secure Token is generated and how to use it.
  2. In the repository, you’ll find two example scripts to generate the tokens, a Python and a PHP script. You can run them locally and generate the token or you can generate these tokens on your own platform with your own code.
  3. Save the generated token, whatever may be the way you generated it through.

Using the Python script as an example, you’ll have the following source code:

#!/usr/bin/env python
import base64
import hashlib
secret = 'mysecret'
uri = '/my/uri'
expire = '1470055000'
md5 = hashlib.md5()
md5.update(secret + uri + expire)
token = base64.b64encode(md5.digest()).replace('=','').replace('+','-').replace('/','_')
print 'http://www.example.org%s?st=%s&e=%s' % (uri, token, expire)

Where:

  • secret: a string of your choice that will be used to generate the token.
  • uri: the URI to use with the token.
  • expire: the expiration time of the token.

Configuring the integration

Setting up an firewall

To instantiate the Secure Token integration, follow the steps:

  1. In the Products menu, select Firewall in the Secure section.
  2. Click the + Firewall button.
  3. Give an easy-to-remember name to your firewall.
  4. Turn the Functions switch on.
  5. Click the Save button.

Done. Now you’ve instantiated the firewall for your function.

Setting up the integration

To instantiate the Secure Token integration, while still on the Firewall page:

  1. Select the Functions Instances tab.
  2. Click the + Function Instance button.
  3. Give an easy-to-remember name to your instance.
  4. On the dropdown menu, select the Secure Token function.
  • This action will load the Arguments tab.

The Arguments tab will load a JSON file that looks like this:

{
"secure_token_secret": "thatisthesecret"
}

Where the secure_token_secret will be the secret string you’ve passed on the code when generating the token on the previous step.

  1. Click the Save button and you’re done. Your Firewall Secure Token integration is now instantiated.

Setting up the Rules Engine

To finish, you have to set up the Rules Engine to configure the behavior and the criteria to run the function.

Still in the Firewall page:

  1. Select the Rules Engine tab.
  2. Click the + Rule Engine button.
  3. Give a name to the rule.
  4. Select a criteria to run and catch the domains that you want to run the integration on.
  • Example: if Host matches yourdomain.com.
  1. Below, select a behavior to the criteria. In this case, it’ll be Run Function.
    • Select the adequate function according to the name you gave it during the instantiation step.
  2. Click the Save button.

On the Console, you must now configure your domain so your firewall protects it.

  1. On the Products menu, select Workloads.
  2. Click on the domain you want to protect with your Secure Token function.
  3. In the Settings section, click on the Firewall selector and choose the firewall you created.
  4. Click the Save button.

The function running on edge servers performs two checks on tokens: whether the current time is greater than the expiration time specified in the token, and whether the signature matches the token signature. If the signature is invalid, the system returns a 403 error, and if the expiry time is exceeded, it returns a 410 error. Malicious users aren’t able to change token expiry time without breaking signature.

Done. Now the Secure Token integration is running for every request made to the domain you indicated.

You can find some examples of code snippets at the Azion public GitHub repository for Secure Token integration.