CDN Hotlink Protection — Investigation & Result

"How do we set our AWS CDN to only allow same-origin host?" — i.e. stop other websites from embedding our skin images and making us pay the egress. A reasonable instinct: a public, unauthenticated CDN means anyone can hotlink it on our dime.

First we mapped what CloudFront does before serving a byte. Distribution EKDMIU4PYOLZ8 (cdn.tradeit.gg) fronts a fully private S3 bucket tradeit-prepared-skins (eu-west-1) via Origin Access Control — the bucket rejects everyone except this one distribution. CloudFront also injects, invisibly, three things that live in the CDN and not in S3:

• CORS headers — an 8-host allowlist (tradeit.gg + staging + dev.tradeit.gg:3000); the bucket itself has no CORS config.
• Cache-Control — forces max-age=2592000, public (30 days).
• Security headers — HSTS (1y, preload) + X-Content-Type-Options: nosniff.

There's no hotlink-protection checkbox on CloudFront (that's a Cloudflare feature). It's custom logic either way. We compared the two mechanisms at our ~44M req/mo:

We wrote a CloudFront Function (viewer-request) that allowed only requests whose Referer/Origin host was tradeit.gg or *.tradeit.gg, ran 8 test events (all green, including dev.tradeit.gg:3000 and spoof cases), published, and associated it to the live distribution.

Root cause: the site sends Referrer-Policy: same-origin. Because cdn.tradeit.gg is a different origin from tradeit.gg, that policy strips the Referer entirely on every cross-origin request to the CDN — and <img> loads aren't CORS requests, so there's no Origin header either. The function saw empty Referer + empty Origin → 403. The test events passed only because we hand-fed them a Referer that real browsers never send.

Before building any defense, we quantified the actual threat. Enabled CloudFront access logging to a dedicated S3 bucket, let it run a full week, then aggregated the cs(Referer) field across 10.0M requests / 81.5 GB:

Top "hotlinkers" were competitor skin sites — games.tapit.gg and www.breakdown.gg — at trivial volume. Extrapolated to monthly traffic, third-party hotlinking costs ~$0.17/month. We had broken every insights-page image to defend against seventeen cents.

• Referer-based hotlink protection is dead for us. With Referrer-Policy: same-origin, ~99% of our own CDN traffic carries no Referer — indistinguishable from a hotlinker who strips it. Any such rule nukes our own traffic.
• Measure the threat in dollars before defending it. The whole CDN bill is ~$76/mo; hotlinking is ~$0.17 of it. The defense cost (an outage, ongoing maintenance, SEO risk) dwarfed the threat.
• The CDN is dual-purpose — never blanket-lock it. If we ever revisit, the only safe shape is a path split: gate the in-app csgo/... prefix (e.g. signed cookies), leave the seo/... prefix public for OG/SEO.
• Test events ≠ real traffic. Synthetic requests with a hand-set Referer passed; real browsers behave differently. For viewer-request gating, validate against real header behavior (or use WAF Count mode) before enforcing.
• CloudFront Functions are ~7× cheaper than WAF for simple header checks, and their 403s aren't cached — which is also what made rollback instant.