title: Google Cloud CDN signed cookies with bucket as backend
body: <p>As an alternative to <a href="https://cloud.google.com/cdn/docs/using-signed-urls?hl=en_US" rel="nofollow noreferrer">signed urls</a> with a url prefix, I'm trying to get <a href="https://cloud.google.com/cdn/docs/using-signed-cookies?hl=en_US" rel="nofollow noreferrer">signed cookies</a> working. Google Cloud CDN is setup with a backend bucket which is configured and working for standard signed urls.</p>
  
  <p>Using these <a href="https://github.com/GoogleCloudPlatform/golang-samples/pull/1286" rel="nofollow noreferrer">Go examples</a> I've implemented a cookie signing function in nodejs(typescript) that when provied with the <a href="https://github.com/GoogleCloudPlatform/golang-samples/blob/52993e68e437a22fd17227601792228839dea6cb/cdn/signedcookies/sign_cookie_test.go#L62" rel="nofollow noreferrer">test sample data</a> produces the expected outcome.</p>
  
  <pre><code>export function signCookie(urlPrefix: any, keyName: string, key: any, experation: Date): string {
      // Base64url encode the url prefix
      const urlPrefixEncoded = Buffer.from(urlPrefix)
          .toString('base64')
          .replace(/\+/g, '-')
          .replace(/\//g, '_');
  
      // Input to be signed
      const input = `URLPrefix=${urlPrefixEncoded}:Expires=${experation.getTime()}:KeyName=${keyName}`;
  
      // Create bytes from given key string.
      const keyBytes = Buffer.from(key, 'base64');
  
      // Use key bytes and crypto.createHmac to produce a base64 encoded signature which is then escaped to be base64url encoded.
      const signature = createHmac('sha1', keyBytes)
          .update(input)
          .digest('base64').replace(/\+/g, '-')
          .replace(/\//g, '_');
  
      // Adding the signature on the end if the cookie value
      const signedValue = `${input}:Signature=${signature}`;
  
      return signedValue;
  }
  </code></pre>
  
  <p>When I then use the same function to produce signed cookie values for my actual cdn instance I get the following (key name and url prefix not actual):</p>
  
  <blockquote>
    <p>URLPrefix=aHR0cHM6L------------------HdhcmUuaW8v:Expires=1587585646437:KeyName=my-key-name:Signature=2mJbbtYVclycXBGIpKzsJWuLXEA=</p>
  </blockquote>
  
  <p>Creating a cooking using firefox dev tools I get the following two results when the cookie is attached and when it is not:</p>
  
  <p><a href="https://i.stack.imgur.com/ljJfk.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ljJfk.jpg" alt="Signed Cookie attached"></a>
  <a href="https://i.stack.imgur.com/ZgurB.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZgurB.jpg" alt="Without signed cookie"></a></p>
  
  <p>It appears that the cookie "Cloud-CDN-Cookie" is just being passed through Cloud CDN and straight to the backend bucket where it's ignored and the standard response access denied response is given.</p>
  
  <p>The cloud platform logs shows no cdn intervention.</p>
  
  <p>With cookie attached
  <a href="https://i.stack.imgur.com/pqTCV.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pqTCV.jpg" alt="with cookie attached"></a>
  No cookie attached
  <a href="https://i.stack.imgur.com/LQF2r.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LQF2r.jpg" alt="without cookie attached"></a></p>
  
  <p>Is there something in either the signing implementation or creation and use of the cookie that I'm doing wrong?</p>