Ask HN: What is the best way to distribute static content with authentication? | Hacker News Reader

Ask HN: What is the best way to distribute static content with authentication?

1 pointMobileVet7 comments

Historically, if one wanted to limit access (either for security reasons or paying customers etc), a server would be handle the authentication and then serve up the content. This could clearly still work but doesn't leverage the power of modern day CDNs.

How does one approach content delivery when the access to the content should be limited? Should a server provide the authentication and then pass along a token that is used to access the CDN? Can the CDN handle token signature verification or other forms that would allow a particular user to be cut off or a cert to be revoked if it was compromised?

I am looking to setup a system to distribute access to some artwork (still and video) and would greatly appreciate a nudge in the right direction or shared experiences around best practices for this type of setup.

there's so many options that it's difficult to say.

Two options are immediately obvious:

First option is to serve only encrypted content, and only hand out the decryption key to the parties that need it. If it's web then you can use javascript to unencrypt- though I'm not a web developer and that could be cumbersome.

This was how we did it for uPlay.

Second option: Akamai/Google CDN have the concept of a "signed" URL: https://cloud.google.com/cdn/docs/using-signed-urls which does basically what you're asking, but can be cumbersome to use in practice too.

Thanks for the suggestions

Another option is Firebase which uses a simple set of rules (on their server, not in your app) to control access to individual data points. The cloud hosting service has easy CLI tools to setup and deploy a static site.

Interesting... I hadn't considered Firebase as I was hoping to go serverless. It may be the easiest user auth system to setup though and the follow on access controls could be handy.

They offer serverless hosting as well. You can develop and build your site with a dev server like Vite.js (with hot reload in the browser), then build and push to Firebase with two CLI calls. Just the JS/HTML/CSS winds up on the Firebase host and you don't need any "server" running. It's terrific!

Try Authelia (https://www.authelia.com)

Very interesting... looking forward to digging into this further. Great suggestion, thank you!

Reply on news.ycombinator.com