3 ms·

Ask HN: What is the best way to distribute static content with authentication?

1 points by MobileVet 4y ago

Historically, if one wanted to limit access (either for security reasons or paying customers etc), a server would be handle the authentication and then serve up the content. This could clearly still work but doesn't leverage the power of modern day CDNs. How does one approach content delivery when the access to the content should be limited? Should a server provide the authentication and then pass along a token that is used to access the CDN? Can the CDN handle token signature verification or other forms that would allow a particular user to be cut off or a cert to be revoked if it was compromised? I am looking to setup a system to distribute access to some artwork (still and video) and would greatly appreciate a nudge in the right direction or shared experiences around best practices for this type of setup.

dijit 4y ago
there's so many options that it's difficult to say. Two options are immediately obvious: First option is to serve only encrypted content, and only hand out the decryption key to the parties that need it. If it's web then you can use javascript to unencrypt- though I'm not a web developer and that could be cumbersome. This was how we did it for uPlay. Second option: Akamai/Google CDN have the concept of a "signed" URL: https://cloud.google.com/cdn/docs/using-signed-urls https://cloud.google.com/cdn/docs/using-signed-urls which does basically what you're asking, but can be cumbersome to use in practice too.
- MobileVet 4y ago
  Thanks for the suggestions
dtagames 4y ago
Another option is Firebase which uses a simple set of rules (on their server, not in your app) to control access to individual data points. The cloud hosting service has easy CLI tools to setup and deploy a static site.
- MobileVet 4y ago
  Interesting... I hadn't considered Firebase as I was hoping to go serverless. It may be the easiest user auth system to setup though and the follow on access controls could be handy.
  - dtagames 4y ago
    They offer serverless hosting as well. You can develop and build your site with a dev server like Vite.js (with hot reload in the browser), then build and push to Firebase with two CLI calls. Just the JS/HTML/CSS winds up on the Firebase host and you don't need any "server" running. It's terrific!
apple314159 4y ago
Try Authelia (https://www.authelia.com https://www.authelia.com)
- MobileVet 4y ago
  Very interesting... looking forward to digging into this further. Great suggestion, thank you!