General
Does the CDN automatically protect my site traffic against denial of service attacks?
Yes. The CDN provides protection against distributed denial of service (DDoS) attacks through its distributed nature, reverse proxy request flow, and intelligent software designed to detect and mitigate volumetric attacks.
Does the CDN protect my site traffic against other security threats?
Yes. We offer a variety of services and features through which additional security measures may be applied to your site traffic.
HTTP Requests
What are the available options for securing HTTP content?
Our CDN network is designed to protect origin servers from volumetric network attacks (e.g., DDoS). Additional protection may be applied to HTTP traffic through the following services/features:
| Service/Feature | Protects Against | ScopeIndicates how the CDN determines whether security will be applied to a request. | Update Links?Indicates whether links to CDN content will require updating to support the service/feature in question. | Purchased Separately |
|---|---|---|---|---|
|
Unauthorized access |
Folder |
No |
No |
|
|
Unauthorized access |
Request Type |
No |
Yes |
|
|
Wiretapping and man-in-the-middle attacks |
Origin Server |
Yes |
||
|
Unauthorized access |
Folder |
Yes |
||
|
Application layer attacks on a customer origin server |
Request Type |
No |
Yes |
How is an unauthorized request for HTTP content handled?
The response for an unauthorized request varies by service/feature.
| Service/Feature | Description |
|---|---|
|
The response for an unauthorized request is a 403 Forbidden. |
|
|
Deny Access Feature The Deny Access feature generates a 403 Forbidden response. Token Auth Feature By default, a request denied by the Token Auth feature will generate a 403 Forbidden response. However, the Token Auth Denial Code feature may be used to generate a 301, 302, 307, 401, or 404 response instead. |
|
|
The response for a HTTP request to a customer origin server where HTTPS has been enabled will vary according to whether the HTTP Edge Protocol option has also been enabled.
|
|
|
By default, an unauthorized request will generate a 403 Forbidden response. However, it can be configured to generate a 301, 302, 307, 401, or 404 response instead. |
|
|
The response for an unauthorized request is a 403 Forbidden. |
May I add a country filter to an individual file?
Yes. By default, Country Filtering may only recursively secure directories. However, Rules Engine may be configured to match requests that originate from one or more countries. It may then be configured to deny these requests.
HTTPS Requests
What type of requests may leverage HTTPS?
Requests that meet the following minimum requirements are capable of supporting HTTPS:
| Type | Minimum Requirement |
|---|---|
|
Origin Server |
Customer Origin CDN Storage |
|
URL |
Edge CNAME URL |
|
Request Type |
Standard HTTP delivery |
HTTPS support requires a TLS certificate to be deployed across network.
What is required to set up HTTPS?
HTTPS support requires the following:
-
HTTPS Activation
If HTTPS has not been activated on your account, then please contact your CDN account manager.
-
Customer Origin Setup
Perform the following steps:
-
Configure your customer origin configuration to use HTTPS.
Enable the HTTPS Edge Protocol option on the desired customer origin server.
-
Enable TLS 1.2 support on your web servers.
Disable support for SSL/TLS versions older than 1.1. Requests to web servers that support older SSL/TLS versions will cause the termination of the TLS handshake and users will land on a "Your connection is not secure" web page.
-
-
Edge CNAME Setup
Create an edge CNAME that points the above hostname to the desired origin server.
-
DNS Setup
Once the requested TLS certificate has been deployed throughout our network, update your DNS configuration.
- Create/update a CNAME record to point to the hostname defined in the SSL Welcome message.
Can I leverage an existing TLS certificate?
Yes. Contact your CDN account manager to learn how you may securely provide the TLS certificate's public key, private key, and intermediate certificate. After which, we will install that TLS certificate throughout our network.
Web Application Firewall
Frequently Asked Questions - Web Application Firewall
CDN Storage
TCC Security
Enforcing strict security on TCC user accounts and Web Service REST API tokens is critical. Exposure of TCC credentials or authentication tokens may allow a malicious user to wreak havoc on your production site traffic.
More Information
Edgecast CDN