---
title: "Discussion on \"Accessing Cloudfront stream with VideoJS and server-side signed cookies\" | Hashnode"
description: "Discussion on \"Accessing Cloudfront stream with VideoJS and server-side signed cookies\". Today's post is a continuation of what I wrote yesterday about  securing Cloudfront stream with signed cookie. I encourage you to open this post especially to look at the UML diagram. There are some things you need to keep in mind to access a stream ..."
url: "https://hashnode.com/posts/accessing-cloudfront-stream-with-videojs-and-server-side-signed-cookies/6082fe62ff5fc65284a7886a"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Accessing Cloudfront stream with VideoJS and server-side signed cookies](https://rubywizards.com/accessing-cloudfront-stream-with-videojs-and-server-side-signed-cookies?utm_source=hashnode&utm_medium=feed)

Today's post is a continuation of what I wrote yesterday about securing Cloudfront stream with signed cookie. I encourage you to open this post especially to look at the UML diagram. There are some things you need to keep in mind to access a stream ...

Apr 23, 2021 · 2 min read · rubywizards.com  
Read the article

-   [#aws](https://hashnode.com/tag/aws)
-   [#streaming](https://hashnode.com/tag/streaming)
-   [#javascript](https://hashnode.com/tag/javascript)

## Written by

[Piotr Jurewicz](https://hashnode.com/@pjurewicz)

@pjurewicz · Łódź, Poland

  
[View profile](https://hashnode.com/@pjurewicz)

ruby on rails developer

## Responses 1

Markdown supported · ⌘↵ to post

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Nov 5](https://hashnode.com/posts/accessing-cloudfront-stream-with-videojs-and-server-side-signed-cookies/6082fe62ff5fc65284a7886a/comment/6aec89a4e4ee234ef660b5e8)

Server-side issuance of signed cookies only helps if the player actually sends them on every media request. Set Cookie Path to cover the playlist and segment prefixes, align Domain with the streaming host the VideoJS source uses, and keep SameSite and Secure flags consistent with how the page loads the player so cross-site iframe embeds do not silently drop the cookies. Keep Authorization and unbounded query strings out of the public cache key; the signature check belongs on the private behaviour while hashed or rangeable media still HITs under a stable key.

Ops prove-out with the real player, not only a raw GET: open the page, confirm the three CloudFront cookie names appear for the media host, then watch the browser network panel for the master playlist and a few segments — expect 200 with Age climbing on repeat segment paths and an immediate edge deny when cookies are cleared mid-session. If only the first request works, check Path coverage and whether the player rewrote the host; if HITs never appear, Cookie is still in the cache key or a second behaviour is bypassing the signed path.