HTTP Caching

HTTP caching significantly speeds up the loading of static objects, such as:

• Images
• Video and audio files
• CSS and JavaScript files
• Documents and other files

Benefits of using HTTP caching:

1. Reduced website response time
2. Improved access reliability
3. Fast loading even for "heavy" pages

Users will be able to quickly load content from any source without delays or interruptions, which will enhance their experience when interacting with your resource.

Setting Up HTTP Caching

To get started with HTTP caching, follow these steps:

1. Navigate to the "CDN" section in the left sidebar
2. Select the "HTTP Caching" tab
3. Click the "Add Resource" button located in the top right corner

After completing these steps, you'll be prompted to select your preferred Content Delivery Optimization method.

Content Delivery Optimization

When creating a resource, you need to choose one of the following content delivery optimization options:

Static Content

• Optimizes delivery of images, video files, JavaScript files, CSS files, etc.

• Text files are compressed (gzip by default) before being served to users.

Large Files

• Optimizes delivery of large files (larger than 20 MB)

• Files from the origin are loaded in parts (HTTP Range requests)

• No compression is performed on the CDN side

• You can specify the size of the range request slice as an integer from 1 to 1024 MB

• Default slice value: 16 MB

Data Source

After selecting the content delivery optimization type, you need to specify the correct data source.

The data source can be:

A domain, for example: www.example.com
An IP address, for example: 86.86.87.88

Example: yourdomain.com:443

When using an S3 domain as a data source, you need to additionally specify the allowed bucket in the corresponding field.

Note: If you have multiple content sources (primary/backup), you'll be able to configure a source pool in the next setup step.

Click the "Create" button to initiate the caching resource creation process. The system will then begin applying the resource settings across the CDN network.

The resource is ready for use when its status changes to "Active".

How to Use

On the right side of the interface, you'll find an "How to Use" block containing important information:

1. Your Domain: A unique URL for accessing your content through the CDN.

2. Link Replacement: Guidelines for correctly replacing resource links to use the CDN.

3. File Path Example: Demonstration of the proper link format.

4. CMS Integration: Information about plugins for popular CMS platforms.

Configuring HTTP Resource

You can make necessary changes to the resource settings immediately after creating it.

Recommendations:

• Carefully review all settings before applying changes
• Plan your changes in advance, considering the application time
• If you're making multiple changes, consider implementing them all at once to minimize overall update time

Resource Configuration

Data Source

If you have multiple content sources (primary/backup), you can add them to a Domain Group and configure the priority for each. If the "highest priority" source becomes unavailable, the CDN network will automatically switch to the next source. It will automatically switch back to the priority source once it's functioning normally again.

You can configure Weight and Max fails for each source.

• Weight is a numerical value that determines what proportion of requests a specific server should receive. The higher the weight, the more requests will be directed to that server. The default weight is 1.

• Max_fails - this parameter defines the number of failed connection attempts to a server, after which Nginx will consider it unavailable for a certain period. The default max_fails value is 10.

Use HTTPS for Source Requests

By default, requests to sources are made using HTTPS. Here you can disable the use of HTTPS if needed.

You can also enable source certificate verification by selecting the corresponding option.

Hostname for Source Requests

If you're using hosting services such as Wix, Amazon S3, Selectel, etc., please pay special attention to the Hostname section.

Many virtual hosting services (such as Amazon S3) host multiple websites on a single web server. For CDN nodes to access your content correctly, you need to specify the correct Hostname.

Follow these steps if you're unsure about your Hostname:

1. Visit your website and right-click on any image to copy its link.
2. Paste this link into a new browser window. The resulting domain is your site's Content Source. For example, if your site is hosted on Wix, the content source domain will be static.wixstatic.com
3. Go to https://check-host.net and enter your website's domain (not the content source domain).
4. On the "Information" tab, look for the "Resource Name" - this is your Hostname. For instance, if you're using Amazon hosting, your Hostname might look like: ec7-54-151-126-156.eu-west-1.compute.amazonaws.com
5. Enter this Hostname in your account dashboard

AWS Authorization

You can use AWS authorization when requesting from sources. To do this, select the corresponding option and enter two keys: the access key and the secret key.

Caching

Here you can specify caching times based on response codes (2xx, 3xx, 4xx, 5xx) and set the option to ignore caching control headers ("Expires" and "Cache-Control").

Initially, each user has basic time settings, but these can be customized.

Ignore caching control headers

If the content source (origin) responses already contain Cache-Control and/or Expires headers, caching is performed for the time specified in these headers. To change this behavior, enable Ignore caching control headers. In this case, caching will be performed for the time specified in this section. The specified caching time will also be used for content source (origin) responses that do not contain caching control headers.

Cache considering query string

When this option is enabled, query string parameters will be taken into account when caching content.

CNAME

A CNAME record allows you to assign an alias to a host. This alias typically associates a specific function with the host or simply shortens its name.

By default, your content is accessible at: example.a.trbcdn.net/images/1.jpg

With CNAME, you can set up access at: cdn.example.com/images/1.jpg

1. Creating a CNAME record:

   • Open the DNS management page on your DNS hosting site
   • Create a new CNAME record with the following parameters:
     • Name (Host): "cdn" Note: Some control panels may require you to specify the full subdomain name, e.g., cdn.example.com
     • Value: example.a.trbcdn.net. (note the period at the end)

2. Waiting for changes to apply:

   • DNS changes may take up to 72 hours to take effect

3. Verifying the setup:

   • After the waiting period, check if your content is accessible at the new address
   • Use DNS checking tools to confirm the correct setup

HTTPS Delivery via CNAME (SSL Certificate)

By default, after saving the settings, your content will be accessible via HTTPS The standard URL will look like: https://example.a.trbcdn.net

If you plan to use an SSL certificate, you have two main options:

a) Upload your own certificate:

• Prepare your SSL certificate in advance
• Upload it before or after creating the resource
• Select the uploaded certificate from the list of available ones when configuring the resource

b) Issue a Let's Encrypt certificate:

• Choose the option to issue a Let's Encrypt certificate in the resource settings
• The system will automatically generate and configure the certificate for your resource

Image Optimization $

This feature allows you to optimize image delivery and modify images on the fly.

Image Delivery Optimization $

This service allows for on-the-fly conversion of images from JPEG, GIF, PNG (.jpg, .jpeg, .png, .gif) formats to WebP (.webp) format.
WebP is a format that uses an advanced compression algorithm, allowing for size reduction in some images without visible quality loss (by 25-35%). The WebP format is supported by most modern browsers.

The platform analyzes the Accept HTTP header from the user's request and determines whether the user's browser supports the WebP format:

• If supported, the user receives the image in WebP format;
• If not supported, the image is delivered in its original format.

Conversion to WebP format occurs automatically in asynchronous mode. This means:

1. You don't need to change your web resource's code and/or the format of image links in advance.
2. The first request from an end-user whose browser supports WebP triggers the image conversion to WebP format. In response to this first request, the image may be delivered in its original format (to avoid conversion delays). After the conversion is complete, all subsequent requests for this image will receive the WebP version (if the end-user's browser supports it).

Image Modification $

This feature allows for on-the-fly image modifications at the time of request. Supported file extensions are jpeg, jpg, gif, png, and webp.

Modifications are applied through special URIs in the format /ioss(<modification parameter>=<value>)/

Available modifications:

Quality Adjustment (quality)

• Parameter: quality
• Values: 1-100 (integer)

Request Examples:

https://example.a.trbcdn.net/ioss(quality=70)/example.jpg

https://example.a.trbcdn.net/ioss(quality=1)/example.jpg

Size Adjustment (resize)

• Parameter: resize
• Format: <width>x<height>, <width>, or x<height>
• Values: 1-4000 (integer, in pixels)

Lossless resizing is only possible when reducing the image size.

Request Examples:

https://example.a.trbcdn.net/ioss(resize=400x300)/example.jpg

https://example.a.trbcdn.net/ioss(resize=x200)/example.jpg

Progressive JPEG (progressive)

Allows the image to be rendered initially at minimum quality, then improved as it loads.

• Parameter: progressive
• Values: y/n

Request Example:

https://example.a.trbcdn.net/ioss(progressive=y)/example.jpg

Applying Optimization and Modification

1. Enable the "Image Optimization" option in the CDN resource settings
2. Use special URIs to apply desired modifications to images
3. Test various parameters to achieve an optimal balance between image quality and size

Video Conversion

This service allows you to convert MP4 files for delivery via HLS or MPEG-DASH streaming protocols.

The service can be enabled for the entire resource, or for a specific path (rule).

Instructions for viewing MP4 files using streaming protocols can be found in the Guide on the resource editing page.

Content Access Restrictions $

In this section, you can set content delivery restrictions based on country and region, IP address, referer, User-Agent, or authorization limitations

Module Configuration Process

1. Activate the type of restriction you need and choose the default rule (deny or allow).
2. Add exceptions to the default rule. For geo-restrictions, also select a rule for the exception itself. This way, you can, for example, deny traffic for an entire country while allowing it for a specific region.
3. If necessary, set time intervals for the rule's validity. Intervals should not overlap.
4. It's possible to add several different rules of each type, provided their time intervals do not overlap.

Authorization by Code Word $

Description:

Authorization of user requests is performed exclusively in the CDN network, external resources are not used. The decision to access a resource is made by means of our network based on the criteria specified by the content owner:

1. Secret key. It is checked that the link was generated by the content owner.
2. The URI of the requested resource. It is checked that the link was generated specifically for this file.
3. User's IP address (optional). It is checked that the resource was requested from exactly the IP address for which the link was generated. You can disable the check by selecting the "Do not impose IP address filter" option.
4. The expiration time of the link (optional). You can turn off the check by selecting the "Do not impose time restrictions" option.

At the moment the user accesses a protected resource, the content owner needs to generate a special link.

Example:

http://example.a.trbcdn.net/md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)/path/to/file

The link contains authorization parameter md5(<md5 hash>[,<expires>]):

• <md5 hash> - MD5 hash in Base64 format for URL, generated based on secret key, URI of the requested resource, user's IP address (optional) and link lifetime (optional);
• <expires> is the expiration time of the link in POSIX time format (optional).

When accessing content using the generated link, the CDN calculates the MD5 value and compares it with the received one. If the MD5 value does not match, then a 403 Forbidden response is returned to the user (access is denied).

If the current time exceeds the value <expires>, then a response with the code 410 Gone (the target resource is no longer available) is returned to the user.

Algorithm for generating an MD5 hash (<md5_hash>) for signing links:

• Form the signature string <secret_word><path_to_file><ip><expire_time>. The <ip> and/or <expire_time> elements are not added to the signature string if Do not impose IP address filter and/or Do not impose time restrictions is specified in the local authorization settings.
• Generate base64_url via base64_url(md5(<signature string>)).
• Generate the <md5 hash> signature by performing the following substitutions in base64_url:
  • replace the = character with the empty string ''.
  • replace the + character with -
  • replace the / character with _
• Form the link using the obtained signature <md5 hash>.

Example of link generation:

1. There are the following input data:

   • Secret key: zah5Mey9Quu8Ea1k
   • User IP address: 1.2.3.4
   • File URI: http://example.a.trbcdn.net/path/to/file
   • Expiration time of the link: 1704067200

2. Form the signature string <secret_word><path_to_file><ip><expire_time>. Let's assume that we include both IP address and link expiration time.

   Then the signature string looks like this: zah5Mey9Quu8Ea1k/path/to/file1.2.3.41704067200

3. Generate <md5 hash>:

   PHP example:

   $ php -r 'print str_replace("=", "",strtr(base64_encode(md5("zah5Mey9Quu8Ea1k/path/to/file1.2.3.41704067200", TRUE)), "+/", "-_")) . "\n";'
   kymJ2w55VH4LUMSKGb6ZqA
   

   Python example:

   #!/usr/bin/python3
   import base64
   import hashlib
   
   secret_word = 'zah5Mey9Quu8Ea1k'
   path = '/path/to/file'
   ip_address = '1.2.3.4'
   expiration_timestamp = 1704067200
   
   def generate_local_signature(secret_word, path, ip_address=None, timestamp=None):
       string_to_sign = f'{secret_word}{path}'
       if ip_address is not None:
           string_to_sign = f'{string_to_sign}{ip_address}'
       if timestamp is not None:
           string_to_sign = f'{string_to_sign}{timestamp}'
   
       hashed_string = hashlib.md5(string_to_sign.encode()).digest()
       decoded_base64_string = base64.b64encode(hashed_string).decode()
       local_signature = decoded_base64_string.replace('+', '-').replace('/', '_').replace('=', '')
       return local_signature
   
   print(generate_local_signature(secret_word, path, ip_address, expiration_timestamp))
   # kymJ2w55VH4LUMSKGb6ZqA
   

4. Result link:

   http://example.a.trbcdn.net/md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)/path/to/file

Authorization by External Script $

External authorization is intended to be able to restrict access to a resource with arbitrary logic described in your authorization script.

The decision on access to content is made based on the response of your script, the link to which you indicate in your personal account when creating/editing a resource.

If the authorization of the script came the reply with a status 200, access to the content is permitted. Otherwise, access is denied.

The authorization script is passed the following headers:

• Host: contains the domain name for which the request is intended;
• X-Request-URI: contains the URI of the requested resource;
• X-Forwarded-For: contains the real IP address of the user who is requesting the resource;
• X-Remote-Addr: contains the IP address of the user who is requesting the resource, or of the proxy server.

Advanced Settings

Use HTTP2

HTTP/2.0 protocol is supported by default. Disable this option if support for this protocol is not required.

Use HTTPS Only

If you want to use only the HTTPS protocol, activate this option.

Automatically Redirect HTTP to HTTPS

By default, your content will be accessible from Global Cloud Network nodes via both HTTP and HTTPS protocols. However, you can set up automatic redirection using this option.

Use Only Modern TLS Versions

By default, all versions of the TLS protocol are used, but you can enable the use of exclusively new versions of the TLS protocol (v1.2, v1.3).

Use Strong SSL Ciphers

You can enable the use of strong SSL ciphers.

Follow Redirects

By default, only responses with "301 Moved Permanently"/"302 Found" codes are cached when received from your origin. Activate this option to allow following redirect addresses and caching the content.

Search Engine Indexing

Using this setting, you can fine-tune the indexing of your content by search engine bots. You can configure proxying of your robots.txt file or upload it from your device to our portal. Before proxying or uploading your robots.txt, we recommend first verifying its correctness on a special resource.

Headers

In this section, you can specify special headers that need to be added when accessing the data source (To source), or when delivering content to end users (For client).

Timeouts

In this section, you can specify acceptable timeouts for CDN nodes when accessing your origin. If the actual values start to exceed the acceptable ones, a switch to another content source specified in the Data Source section will occur.

CORS Check on CDN Side

Description

In some cases, a browser may treat a request to access to certain content hosted on a CDN network as a cross-domain request and block it. It is primarily related to fonts. The issue is addressed by setting CORS (Cross-Origin Resource Sharing) headers for cached objects.

There are two options:

1. You can set CORS headers on the origin server and disable their verification in our network yourself.
2. You can set up CORS verification in the Your Account section in our network.

Setup in Your Account

The CORS verification procedure provided for configuration is based on our proprietary module operation. Its functionality is based on W3C recommendations.

Module Operation Fundamentals:

1. Where CORS is enabled, Access-Control-* headers from the origin are always ignored and excluded from the response.

2. Any request without Origin header is not a cross-resource request, and Access-Control-* headers are not transmitted to the client.

3. Our module never adds Access-Control-Request-* headers, since they are incoming request headers generated by the browser, same as Origin.

4. Where there is an Origin header, its contents will be matched against that set by the user. In the absence of restrictions, the Access-Control-Allow-Origin response header will include "*", while where there are any restrictions and where Origin is on the allowed list, then ACAO will include http(s?)://${http_origin}; otherwise, the response will include Access-Control-* headers.

5. Access-Control-Expose-Headers headers are added, if such headers are set by the user. By default, we state a permission to access Content-Range for the operation of range-requests (for JS-based players).

6. Access-Control-Allow-Credentials (ACAC) headers are included in accordance to that set by the user.

7. Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age headers are included only in a response to a request based on the OPTIONS method, which is processed locally and not forwarded to the origin.

8. Access-Control-Allow-Methods header is set to be equal to the contents of the Access-Control-Request-Method header, if such header is present and is on the list of simple requests (GET, HEAD, POST), or a list set by the user. Where the method is not on the allowed list, then the response will not include Access-Control-* headers. If a request does not contain Access-Control-Request-Method, no Access-Control-Allow-Methods will be set.

9. Access-Control-Allow-Headers is set to be equal to the contents of the Access-Control-Request-Headers header, if such header is present, Access-Control-Request-Method request header is present, and all headers are on the list of simple headers (Accept, Accept-Language, Content-Type, Content-Language) or on the user-set list. Where at least one header is not on the allowed list, then the response will not contain Access-Control-* headers. Where a request does not contain Access-Control-Request-Method and Access-Control-Request-Headers, Access-Control-Allow-Headers will not be stated.

10. Access-Control-Max-Age header will be stated in accordance with that set by the user, but not by default.

11. Any additional response header, specified by the client, will be added/overridden after CORS module processing, while, for example, Access-Control-Allow-Origin: * in header sections will be added irrespective of the CORS module operation results.

Module Configuration Process

CORS verification is active by default. If CORS authorization is disabled, all preflight requests will be forwarded to your origin. The headers, described above and set on the origin, will not be affected and will be transmitted unchanged to end users.

You may adjust the module operation by setting the following parameters:

Allowed Domains (not verified by default, all domains are allowed)

Values may set by either of the following methods:

1. example.com – exact match
2. *.example.com - all subdomains example.com exclusive of example.com
3. .example.com – all Level 3 domains inclusive of example.com
4. ~a\d+\.example.com – regular expression

Secure Request Headers

Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma are allowed by default. You may add your headers to this list.

Upper Level API Accessible Headers (Expose Headers)

Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma are allowed by default. You may add your headers to this list.

Safe Methods

GET, HEAD, POST are allowed by default. You may add your methods to this list.

Access-Control-Allow-Credentials Header

Cookies, sessions, authorizations are incompatible with caching services due to their operating logic. However, if you need to set an Access-Control-Allow-Credentials header, you can do it.

Preflight Request Response Lifetime

A period of time during which a response to a Preflight request is deemed to be relevant.

Brotli Compression $

This option allows you to enable Brotli compression.

Brotli is an open-source, lossless data compression algorithm proposed by Google in 2015. It uses a dictionary with frequently occurring string sequences in text files (e.g., .css, .js), which allows it to achieve on average 20% higher compression rates compared to gzip. It can be enabled for the entire resource or for specific paths through rules in the account interface. It only works over HTTPS.

Compression is possible for the following file types:

• application/javascript
• application/json
• application/vnd.apple.mpegurl
• application/vnd.ms-fontobject
• application/x-font-opentype
• application/x-font-truetype
• application/x-font-ttf
• application/x-javascript
• application/xml
• application/xml+rss
• font/eot - font/opentype
• font/otf - image/svg+xml
• image/vnd.microsoft.icon
• image/x-icon
• text/compressible
• text/css
• text/javascript
• text/xml

For compression to work correctly, the browser must send the header Accept-Encoding: br (supported in browsers based on Chrome 49+, Firefox 44+, Opera 36+).

Rules

This section is designed for more fine-tuned configuration of the CDN network. Individual rules for any section/path allow you to manage headers, caching, CORS, authorization, and other parameters.

Creating a Rule

To create a rule, specify the path to the directory or to a specific file to which this rule should be applied.

Headers

Headers for a specific path (rule) are configured similarly to the option for the entire resource.

Caching

Caching for a specific path (rule) is configured similarly to the option for the entire resource.

Image Optimization

Image optimization for a specific path (rule) is configured similarly to the option for the entire resource.

Video Conversion

Video conversion for a specific path (rule) is configured similarly to the option for the entire resource.

Content Access Restrictions $

Restrictions for a specific path (rule) are configured similarly to the restrictions for the entire resource.

Brotli Compression $

Brotli compression for a specific path (rule) is configured similarly to the option for the entire resource.

CORS Check on CDN Side

CORS check on CDN side for a specific path (rule) is configured similarly to the option for the entire resource.