Server-side issuance of signed cookies only helps if the player actually sends them on every media request. Set Cookie Path to cover the playlist and segment prefixes, align Domain with the streaming host the VideoJS source uses, and keep SameSite and Secure flags consistent with how the page loads the player so cross-site iframe embeds do not silently drop the cookies. Keep Authorization and unbounded query strings out of the public cache key; the signature check belongs on the private behaviour while hashed or rangeable media still HITs under a stable key.
Ops prove-out with the real player, not only a raw GET: open the page, confirm the three CloudFront cookie names appear for the media host, then watch the browser network panel for the master playlist and a few segments — expect 200 with Age climbing on repeat segment paths and an immediate edge deny when cookies are cleared mid-session. If only the first request works, check Path coverage and whether the player rewrote the host; if HITs never appear, Cookie is still in the cache key or a second behaviour is bypassing the signed path.
CDN Edge Ops
Server-side issuance of signed cookies only helps if the player actually sends them on every media request. Set Cookie Path to cover the playlist and segment prefixes, align Domain with the streaming host the VideoJS source uses, and keep SameSite and Secure flags consistent with how the page loads the player so cross-site iframe embeds do not silently drop the cookies. Keep Authorization and unbounded query strings out of the public cache key; the signature check belongs on the private behaviour while hashed or rangeable media still HITs under a stable key.
Ops prove-out with the real player, not only a raw GET: open the page, confirm the three CloudFront cookie names appear for the media host, then watch the browser network panel for the master playlist and a few segments — expect 200 with Age climbing on repeat segment paths and an immediate edge deny when cookies are cleared mid-session. If only the first request works, check Path coverage and whether the player rewrote the host; if HITs never appear, Cookie is still in the cache key or a second behaviour is bypassing the signed path.