Generate signed URLs

EdgeSecurity token authentication stops hotlinking of paid downloads and VOD. Keep the secret on origin; never in JavaScript.

$expires = time() + 600;
$token = hash_hmac('sha256', $path . $expires, $secret);
$url = "https://cdn.example.com{$path}?secure={$token}&expires={$expires}";

Reject requests when time() > expires or the HMAC does not match. Product: EdgeSecurity. Glossary: signed URLs.