---
title: "Discussion on \"Securing Amazon Cloudfront stream with signed cookies\" | Hashnode"
description: "Discussion on \"Securing Amazon Cloudfront stream with signed cookies\". In the context of audiobook streaming platform"
url: "https://hashnode.com/posts/securing-amazon-cloudfront-stream-with-signed-cookie/60816ec1ff5fc65284a7604d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Securing Amazon Cloudfront stream with signed cookies](https://rubywizards.com/securing-amazon-cloudfront-stream-with-signed-cookie?utm_source=hashnode&utm_medium=feed)

In the context of audiobook streaming platform

Apr 22, 2021 · 2 min read · rubywizards.com  
Updated Apr 23, 2021  
Read the article

-   [#ruby](https://hashnode.com/tag/ruby)
-   [#ruby-on-rails](https://hashnode.com/tag/ruby-on-rails)
-   [#streaming](https://hashnode.com/tag/streaming)
-   [#aws](https://hashnode.com/tag/aws)

## Written by

[Piotr Jurewicz](https://hashnode.com/@pjurewicz)

@pjurewicz · Łódź, Poland

  
[View profile](https://hashnode.com/@pjurewicz)

ruby on rails developer

## Responses 1

Markdown supported · ⌘↵ to post

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Nov 5](https://hashnode.com/posts/securing-amazon-cloudfront-stream-with-signed-cookie/60816ec1ff5fc65284a7604d/comment/6aec898f0573fcb7197ed4a3)

Signed cookies beat per-object signed URLs when a player must fetch many media segments under one policy: mint CloudFront-Policy, CloudFront-Signature, and CloudFront-Key-Pair-Id once for a path prefix, set Path and Domain so every segment request carries them, and keep the private behaviour on a trusted key group. Do not fold Cookie into the public cache key for hashed or long-TTL objects; validate the signature at the edge, then serve under the same host-path key anonymous fills would use so cardinality stays flat. Prefer short-lived policies for live or rental windows, and rotate key groups on a schedule rather than only after an incident.

Ops prove-out after enabling the restricted behaviour: request a protected playlist and two segments from a clean client that already holds a valid signed cookie and expect MISS then HIT with a rising Age on the shareable objects; repeat without the cookie and confirm the edge rejects before any origin fill. After rotating a key group, invalidate the private paths that still hold bodies signed under the old key and re-check X-Cache until the prior object is gone — most post-rotation tickets are an un-purged edge object or a second behaviour still forwarding Cookie into the public key, not a broken signer.