aws cloudfront signed urls and mediapackage

Question

I'm using aws mediapackage and aws cloudfront to serving video on demand. Due to the security reasons, I have have cdn authorization for my packaging group in mediapackage and it works which means all assets are available only from cloudfront. But for more security, i need to restrict access by using signed urls. when i enable this feature in cloudfront console, restriction works fine and my urls return 403 forbidden. when i sign a url, i won't receive 403 but the problem is streaming is not working anymore. which means i have below error in my browser's console:

Access to XMLHttpRequest at 'https://xxxxxxxxxx.cloudfront.net/out/v1/xxxxxxxxxxxxxxx.m3u8' from origin '127.0.0.1:8000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Answer 1

CORS policy is irrelevant here. I think the main issue is that the player you are using is not requesting child manifest with signed URL or the signature used in the signed URL is invalid.

Can you check URL requesting "https://xxxxxxxxxx.cloudfront.net/out/v1/xxxxxxxxxxxxxxx.m3u8" in the debug mode whether it includes Expires, signature and Key-Pair-Id

Each manifest and segments has a different base URL. This means the signature used in the signed URL is different. You have to make sure your player uses the correct signature when playback

Thanks, Sam