Amazon CloudFront now supports SHA-256 for signed URLs and signed cookies

Amazon CloudFront SHA-256 Signed URLs and Cookies

Amazon CloudFront now supports SHA-256 as a hash algorithm for creating signed URLs and signed cookies. SHA-256 provides an improved security posture with stronger collision detection and alignment with modern cryptographic standards, giving you stronger cryptographic signing when restricting access to content.

To use SHA-256, include the Hash-Algorithm=SHA256 query parameter in your signed URLs, or the CloudFront-Hash-Algorithm=SHA256 cookie attribute for signed cookies. Existing signed URLs and signed cookies that don't specify a hash algorithm continue to use SHA-1, so this change is fully backwards compatible.

What to do

• Update your signed URLs and cookies to use SHA-256 by adding the appropriate query parameter or cookie attribute.
• Review your security and compliance requirements to ensure SHA-256 meets your needs.
• Consult the Amazon CloudFront Developer Guide for more information on creating signed URLs and cookies.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.