--- title: "Secure token and signed access" description: "How signed URLs and signed cookies gate adult CDN content without polluting the cache key, plus expiry, range retries, IP binding, and token refresh design." url: "https://adultinfra.com/docs/cdn/secure-token/" dateModified: "2026-09-12" --- [Home](https://adultinfra.com/) / [Docs](https://adultinfra.com/docs/) / Delivery and CDN # Secure token and signed access How signed URLs and signed cookies gate adult CDN content without polluting the cache key, plus expiry, range retries, IP binding, and token refresh design. LAST REVIEWED 2026-09-13 ON THIS PAGE - [Signed URLs versus signed cookies](https://adultinfra.com/docs/cdn/secure-token/#signed-urls-versus-signed-cookies) - [Keep auth out of the reusable cache key](https://adultinfra.com/docs/cdn/secure-token/#keep-auth-out-of-the-reusable-cache-key) - [Expiry and range retries](https://adultinfra.com/docs/cdn/secure-token/#expiry-and-range-retries) - [IP binding](https://adultinfra.com/docs/cdn/secure-token/#ip-binding) - [Refresh](https://adultinfra.com/docs/cdn/secure-token/#refresh) - [Where AdultInfra fits](https://adultinfra.com/docs/cdn/secure-token/#where-adultinfra-fits) Adult platforms must gate paid, member-only, or geo-restricted content without turning every request into a cache miss. **Secure tokens** (signed URLs or signed cookies) let the edge verify entitlement and still serve a shared cache entry. The design principle is constant: authenticate the viewer, but key the cache on the object, not the viewer. ## Signed URLs versus signed cookies Both schemes sign a set of claims with a shared secret or key pair and let the edge validate before serving. They differ in where the signature travels. Scheme Signature location Best for Watch out for Signed URL Query string or path segment Single asset, embed, or API response Every unique signature risks a unique cache key Signed cookie Cookie header Many assets per session (player, manifests, segments) Cookies must not enter the cache key Signed cookies are usually the better fit for video: one cookie authorises an entire playback session across a manifest and hundreds of segment requests, and the segment URLs stay identical for every viewer, so they share one cache entry. ## Keep auth out of the reusable cache key This is the rule that decides whether signed delivery scales or collapses. If the signature, token, or session value is part of the cache key, every viewer is a unique object and the cache becomes a pass-through. Instead: - Validate the token at the edge and **strip it before deriving the cache key**, or place it in a cookie the cache ignores. - Never include a per-viewer value in the path or in whitelisted query parameters used for keying. See [Cache control and cache keys](https://adultinfra.com/docs/cdn/cache-control/). - Normalise signed URLs so equivalent entitlement produces the same keyed object. - If a parameter must remain in the URL for the origin, ensure it is excluded from edge keying and not forwarded into origin logs. The result: one cached segment serves every authorised viewer, and entitlement is still enforced on each request. ## Expiry and range retries Expiry is a correctness and a cache concern. - **Short expiries** reduce the blast radius of a leaked URL but force clients to refresh tokens mid-session. - **Long expiries** are convenient but mean a shared link stays valid far longer than intended. - Sign the smallest useful window: long enough to cover a playback session plus a margin, short enough that a leak is short-lived. Byte-range seeking interacts badly with tight expiry. A player that seeks after the token expires gets `403` responses on range retries and stalls, even though the manifest is fine. Design for it: - Use signed cookies with a session-length expiry for video, and refresh the cookie before it lapses. - Return a clear, non-cacheable error on expired tokens so a `403` is not cached and mistaken for a missing object. - Do not sign each range request independently; sign the object and let ranges flow through. ## IP binding Binding a token to the viewer’s IP blocks link sharing, but it has real costs: - Mobile and CGNAT viewers change IP mid-session, causing legitimate failures. - IP binding prevents caching at shared egress points and can fragment cache behaviour by client network. - If you bind, bind to a prefix or a short-lived session, not a strict single address, and make the failure path a re-auth rather than a hard error. For most adult platforms, session-scoped signed cookies with a modest expiry outperform strict IP binding on both security and viewer experience. ## Refresh Tokens must be renewable without a full re-authentication. Keep the authorisation check at your application, issue a fresh token to the client, and let the edge trust the token until expiry. Avoid issuing tokens so short that the player spends more time refreshing than playing, and ensure a refresh does not require a page reload or a new playback session. ## Where AdultInfra fits AdultInfra designs token schemes that gate content without wrecking byte offload, and verifies that signed range requests, expiry, and refresh behave correctly under seek-heavy traffic. Bring one hostname and the access model you need and [talk to us](https://adultinfra.com/contact/). **Need this configured for your platform?** [Get a test plan](https://adultinfra.com/contact/) and an engineer will map the resource, cache, and delivery design to your workload. ```json {"@context":"https://schema.org","@graph":[{"@type":"TechArticle","headline":"Secure token and signed access","description":"How signed URLs and signed cookies gate adult CDN content without polluting the cache key, plus expiry, range retries, IP binding, and token refresh design.","url":"https://adultinfra.com/docs/cdn/secure-token/","dateModified":"2026-09-13","keywords":"CDN secure token, signed URL, signed cookies, video access control, adult content protection","author":{"@id":"https://adultinfra.com/#organization"},"publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://adultinfra.com/"},{"@type":"ListItem","position":2,"name":"Documentation","item":"https://adultinfra.com/docs/"},{"@type":"ListItem","position":3,"name":"Secure token and signed access","item":"https://adultinfra.com/docs/cdn/secure-token/"}]}]} {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://adultinfra.com/#organization","name":"AdultInfra","url":"https://adultinfra.com","logo":"https://adultinfra.com/favicon.svg","description":"Luxembourg-based specialist infrastructure for adult platforms.","slogan":"Already behind the adult internet.","areaServed":"Worldwide","knowsAbout":["Adult video CDN","Porn tube site infrastructure","Adult live-cam streaming","Creator subscription platforms","Byte-range video caching","Origin shielding","Player quality of experience","DDoS protection","GPU infrastructure","Adult-capable AI inference"],"location":{"@type":"Place","name":"Luxembourg","address":{"@type":"PostalAddress","addressCountry":"LU"}},"contactPoint":{"@type":"ContactPoint","contactType":"sales","url":"https://adultinfra.com/contact/"}},{"@type":"WebPage","@id":"https://adultinfra.com/docs/cdn/secure-token/#webpage","url":"https://adultinfra.com/docs/cdn/secure-token/","name":"Secure token and signed access","description":"How signed URLs and signed cookies gate adult CDN content without polluting the cache key, plus expiry, range retries, IP binding, and token refresh design.","isPartOf":{"@id":"https://adultinfra.com/#website"},"about":{"@id":"https://adultinfra.com/#organization"},"primaryImageOfPage":{"@type":"ImageObject","url":"https://adultinfra.com/og-default.png"},"inLanguage":"en","mainEntity":{"@id":"https://adultinfra.com/docs/cdn/secure-token/#article"},"dateModified":"2026-09-13"},{"@type":"WebSite","@id":"https://adultinfra.com/#website","url":"https://adultinfra.com","name":"AdultInfra","description":"Luxembourg-based specialist infrastructure for adult platforms.","publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en","potentialAction":{"@type":"ContactAction","target":"https://adultinfra.com/contact/"}}]} ```