General
Does the CDN automatically protect my site traffic against denial of service attacks?
Yes. The CDN provides protection against distributed denial of service (DDoS) attacks through its distributed nature, reverse proxy request flow, and intelligent software designed to detect and mitigate volumetric attacks.
Does the CDN protect my site traffic against other security threats?
Yes. We offer a variety of services and features through which additional security measures may be applied to your site traffic.
HTTP Requests
What are the available options for securing HTTP content?
Our CDN network is designed to protect origin servers from volumetric network attacks (e.g., DDoS). Additional protection may be applied to HTTP traffic through the following services/features:
| Service/Feature | Protects Against | ScopeIndicates how the CDN determines whether security will be applied to a request. | Update Links?Indicates whether links to CDN content will require updating to support the service/feature in question. | Purchased Separately |
|---|---|---|---|---|
|
Unauthorized access |
Folder |
No |
No |
|
|
Unauthorized access |
Request Type |
No |
Yes |
|
|
Wiretapping and man-in-the-middle attacks |
Origin Server |
Yes |
||
|
Denial of service attacks and spikes in traffic to a customer origin server |
Customer Origin Server |
No |
Yes |
|
|
Unauthorized access |
Folder |
Yes |
||
|
Application layer attacks on a customer origin server |
Request Type |
No |
Yes |
How is an unauthorized request for HTTP content handled?
The response for an unauthorized request varies by service/feature.
| Service/Feature | Description |
|---|---|
|
The response for an unauthorized request is a 403 Forbidden. |
|
|
Deny Access Feature The Deny Access feature generates a 403 Forbidden response. Token Auth Feature By default, a request denied by the Token Auth feature will generate a 403 Forbidden response. However, the Token Auth Denial Code feature may be used to generate a 301, 302, 307, 401, or 404 response instead. |
|
|
The response for a HTTP request to a customer origin server where HTTPS has been enabled will vary according to your customer origin configuration.
|
|
|
A standard HTTP response is always provided. |
|
|
The stream will not play. The media player determines the message that will be displayed to the user. |
|
|
By default, an unauthorized request will generate a 403 Forbidden response. However, it can be configured to generate a 301, 302, 307, 401, or 404 response instead. |
|
|
The response for an unauthorized request is a 403 Forbidden. |
May I add a country filter to an individual file?
Yes. By default, Country Filtering may only recursively secure directories. However, Rules Engine may be configured to match requests that originate from one or more countries. It may then be configured to deny these requests.
HTTPS Requests
What type of requests may leverage HTTPS?
Requests that meet the following minimum requirements are capable of supporting HTTPS:
| Type | Minimum Requirement |
|---|---|
|
Origin Server |
Customer Origin CDN Storage |
|
URL |
Edge CNAME URL |
|
Request Type |
Standard HTTP delivery |
HTTPS support requires a TLS certificate to be deployed across network.
What is required to set up HTTPS?
HTTPS support requires the following:
-
HTTPS Activation
If HTTPS has not been activated on your account, then please contact your CDN account manager.
-
TLS Certificate
Perform one of the following steps:
-
Certificate Provisioning System: Set up a TLS certificate via the Certificate Provisioning System.
-
Legacy HTTPS: Request a TLS certificate from your CDN account manager. Make sure to have the following information at hand:
-
-
Customer Origin Setup
Perform the following steps:
-
Configure your customer origin configuration to use HTTPS.
- Customer Origin Group: For each desired origin entry within your customer origin group, set the Protocol Type option to HTTPS Only.
- Customer Origin - Legacy: Enable the HTTPS Edge Protocol option on the desired customer origin server.
-
Enable TLS 1.2 support on your web servers.
A recommended best practice is to disable support for SSL/TLS versions older than 1.1.
-
-
Edge CNAME Setup
Create an edge CNAME that points the above hostname to the desired origin server.
-
DNS Setup
Once the requested TLS certificate has been deployed throughout our network, update your DNS configuration.
- HTTPS - Certificate Provisioning System: Create/update a CNAME record to point a SAN to the certificate's target CNAMEIdentifies a system-defined CNAME record through which HTTPS requests will be routed. You must update your DNS configuration to point a CNAME record to this target CNAME..
-
Can I leverage an existing TLS certificate?
Yes. Contact your CDN account manager to learn how you may securely provide the TLS certificate's public key, private key, and intermediate certificate. After which, we will install that TLS certificate throughout our network.
Defend
Frequently Asked Questions - Web Application Firewall
CDN Storage
MCC Security
Enforcing strict security on MCC user accounts and Web Service REST API tokens is critical. Exposure of MCC credentials or authentication tokens may allow a malicious user to wreak havoc on your production site traffic.
More Information