Skip to main content
If the origin restricts incoming requests, grant Gcore CDN edge servers access in one of these ways:
  • Authenticate requests with an HTTP header name-value pair (recommended)
  • Allow CDN server host CIDRs
  • Allow CDN server network ranges
The list of CDN edge host CIDRs and networks changes as the network expands. New entries appear in the public lists 30–60 minutes before a server starts serving traffic. Missing an entry from the origin allowlist blocks content for users served by that edge. Prefer the HTTP header method, or automate allowlist updates from the public endpoints.

​
HTTP header access

Authenticate CDN requests with an unpredictable header name-value pair because a header name alone can be copied by any client. Generate a 32-byte value with a cryptographically secure generator:
Configure request headers so Gcore sends the exact pair with every origin request. Configure the CDN resource to pull content from the origin over HTTPS and validate the origin certificate so the header value remains encrypted in transit. Configure the origin to accept requests only when both the header name and value match, and reject requests with a missing or incorrect pair. Protect the value as a secret, avoid exposing it in logs or client-side code, and rotate it in both Gcore and the origin configuration if it is exposed. This method does not need updates when CDN edge addresses change.

​
IP address access

The public IP endpoint returns IPv4 /32 and IPv6 /128 host CIDRs. Poll it every 10 minutes, apply additions immediately, and add each value to the origin allowlist exactly as returned:
The IP and network commands require jq to extract both arrays from each JSON response. Install it before running either command.
The request requires no authorization. The JSON response stores IPv4 host CIDRs in addresses and IPv6 host CIDRs in addresses_v6.

​
Network range access

The public network endpoint returns broader IPv4 and IPv6 CIDR ranges. Poll it every 10 minutes, apply additions immediately, and add each range to the origin allowlist exactly as returned:
The request requires no authorization. The JSON response stores IPv4 networks in addresses and IPv6 networks in addresses_v6.

​
Access verification

Test an allowed CDN request and a blocked direct request after changing the origin rules.
1

Test access through the CDN

Request a known file through the CDN custom domain and confirm that the response contains the expected file.
2

Test blocked direct access

Request the same file directly from the origin. For HTTP header access, omit the required name-value pair or send an incorrect value. For IP or network access, send the request from a source outside the allowlist. Confirm that the origin rejects the request.