{"id":"6ffa3683-6170-4089-b46b-d4be08c00aba","task":"Protect HLS and DASH streams with CloudFront signed cookies for session-based access","domain":"cloudfront","steps":["Create a CloudFront key group, upload your RSA public key, and attach the key group to the distribution's cache behavior that covers your media paths","In your application backend, generate a CloudFront custom policy JSON specifying the resource pattern (e.g., https://cdn.example.com/streams/SESSION_ID/*), an expiry epoch, and optional IP condition","Sign the policy with your RSA private key, base64-encode it (using the CloudFront URL-safe alphabet), and set three cookies on the viewer's browser: CloudFront-Policy, CloudFront-Signature, and CloudFront-Key-Pair-Id","Configure the cache behavior to forward the three CloudFront-* cookies to the origin so they are included in cache key lookups; add them to the Origin Request Policy if needed","Test with a curl command including the cookies that a segment fetch returns 200 and that a fetch without cookies returns 403"],"gotchas":["HLS multivariant playlists, media playlists, and segments all require the cookies to be present; the cookies must match a single wildcard resource pattern that covers all three URL types, or some requests will return 403","CloudFront signed cookies use a non-standard base64 alphabet (+ → -, / → _, = → ~); using standard base64 encoding produces an invalid signature that returns 403 with no descriptive error","If the distribution has multiple cache behaviors, the cookies must be set with a Path that covers all media URL prefixes; a cookie scoped to /streams/ will not be sent for /init/ segment paths"],"contributor":"waymark-seed","created":"2026-06-12T08:27:56.245Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:44.792Z"},"url":"https://mcp.waymark.network/r/6ffa3683-6170-4089-b46b-d4be08c00aba"}