Learn how to set access permissions to files, documents, and media using Cloudflare Token Authentication.

Overview

Cloudflare Token Authentication allows you to restrict access to documents, files, and media to selected users without requiring them to register. This helps protect paid/restricted content from leeching and unauthorized sharing. 

There are two options to configure Token Authentication, via Cloudflare Workers or the Cloudflare Web Application Firewall (WAF).

Option 1: Configure using Cloudflare Workers

Review the following Cloudflare Workers documentation to configure Token Authentication:

• Configure a Worker
• Use the Auth with Headers template

Option 2: Configure using a Custom WAF Rule

1. Log in to your Cloudflare account 
2. Click the appropriate Cloudflare account for the domain where you want to enable Token Authentication.
3. Click the Firewall app.
4. Click the Managed Rules tab, then toggle the WAF to On.
5. Click Request a rule.

6. Include the following information in the text box that appears:

• the path you wish to authenticate (e.g. domain.com/download/*);
• the parameter name you wish the token to have (e.g. verify);
• the desired token expiration times if any (e.g. 5 and 20 minutes); and 

7. Finally, create and share a secret key (preferably 32 bytes long) with Cloudflare support.

After submitting the custom WAF rule request, Cloudflare will deploy the rule to your account.

Once available the rule is added to the Cloudflare dashboard it will look like this:

You can now enable or disable each rule independently or test them in Simulate mode.

Implement token creation

Implementing the token creation requires the following code entered at your origin server:

PHP Version

<?php
// Generate valid URL token
$secret = "thisisasharedsecret";
$time   = time();
$token  = $time . "-" . urlencode(base64_encode(hash_hmac("sha256", "/download/private.jpg$time", $secret, true)));
param   = "verify=" . $token;
?>

Python Version

import hmac
import base64
import time
import urllib
from hashlib import sha256

secret = "thisisasharedsecret"
time   = str(int(time.time()))
digest = hmac.new(secret, "/download/cat.jpg" + time, sha256)
param  = urllib.urlencode({'verify': '%s-%s' % (time, base64.b64encode(digest.digest()))})

This will generate a URL parameter such as:

verify=1484063137-IaLGSmELTvlhfd0ItdN6PhhHTFhzx73EX8uy%2FcSDiIU%3D

Which you will then need to append to any URL under the domain.com/download/* path. For example:

/download/cat.jpg?verify=1484063787-9JQB8vP1z0yc5DEBnH6JGWM3mBmvIeMrnnxFi3WtJLE%3D

Please note that the token parameter needs to be the last parameter in the query string. You can test if URLs are being generated correctly on the server by enabling the WAF rules on simulate and monitoring the WAF logs and the Traffic app in the Cloudflare dashboard.