Token Authentication for Cached Private Content and APIs

Introduced Token Authentication as a feature to control access to cached private content and APIs. This feature allows for access control via URL tokens or HTTP request headers, validated at the edge before reaching the origin or cache. The token is an HMAC generated from a shared secret, resource path, and timestamp. It supports both static content protection (e.g., downloads) and API authentication, where tokens are provided by the origin server after initial authentication. The implementation involves configuring rules within the Web Application Firewall (WAF) Custom User Rule Set Package, with options for simulate, challenge, or block actions. Customization of the WAF block page is also supported. The post provides PHP code examples for generating URL tokens and outlines the benefits for API protection, including statelessness, CSRF prevention, and reduced origin load. It also mentions embedding and encrypting shared secrets within mobile applications for API endpoint protection.