0

AWS documentation has explained how to sign the cookie and set the cookie.

  1. sign the cookie use the private key
  2. set cookie
  3. the browser of the user carries the cookie and tries to download the file.
  4. CloudFront validates the cookie and responds to the request.

I have gone through several related questions.

  1. Stackoverflow: Setting Cookies for CloudFront
  2. Stackoverflow: share cookie between subdomain and domain

Due to security, it seems not possible to share cookies between different subdomains.

Take this real-world scenario as an example:

  • Web application's domain www.example.com
  • AWS CloudFront distribution file.example.com

How does www.example.com(web application) set a signed cookie for file.example.com(CloudFront)?

Ryan Lyu
  • 1,499
  • 1
  • 12
  • 22
  • 1
    Generally speaking `www.example.com` can issue cookies for both `www.example.com` and `example.com` - the `example.com` cookies will be sent along when requesting `file.example.com` or even `something.more.complex.example.com`. – luk2302 Apr 06 '21 at 08:50
  • a nice article to explain the approaches: https://stackoverflow.com/questions/41990841/how-to-use-cloudfront-signed-cookies-in-the-browser – Ryan Lyu Apr 11 '21 at 13:20
  • related question: https://stackoverflow.com/questions/41990841/how-to-use-cloudfront-signed-cookies-in-the-browser – Ryan Lyu Apr 11 '21 at 13:20

0 Answers0