7

I'm trying out the Office 365 Public CDN feature as described here

But I'm interested in what is "Public" about this. Towards the bottom of the article these is this answer in the Q&A:

Can I use this CDN from outside of SharePoint Online?

No. There is referrer limitation on the CDN URL requests. You can only reference assets from the CDN URLs when request is coming from the SharePoint Online.

This seems to suggest the files can't be accessed from outside of SharePoint Online.

So does this mean any authenticated user in my tenant has read access to the files in the CDN? Or any user in ANY tenant has read access (the "public" bit)?

Also, does anyone know if I enable CDN on a document library that's being used as an asset library that I'll need to update all my URLs? This seems to suggest I may not by now:

Notice. During developer preview, you will need to explicitly update the URL of shared assets in the pages and in the customizations to match CDN URL addresses. We are however working on doing this automatically with updated version, which is planned to be available later this calendar year before full worldwide release.

Improve this question

2 Answers 2

Reset to default
2

"public" means that technically files are available anonymously through the CDN URLs. There is referrer filtering, which will block Office 365 CDN to be used as the hosting location for assets which are not used in SharePoint.

It's important to notice that you will only expose static assets like JS files or images, not actual content. Only those which are located in the CDN origins.

If you use Public CDN option, there's no automatic URL rewrite.

If you, however, take advantage of the private CDN option, there are other differences as private CDN is only for authenticated users and URL rewriting happens automatically. Private CDN though means also that the CDN URL to assets is not static and keeps changing automatically.

Hopefully that clarified things a bit.

Improve this answer
1
  • Hi Vesa, Are there any protections in place for referrer spoofing?
    – James Randal
    Aug 30, 2019 at 6:04
0

I'm sorry, Vesa. I'd add a comment onto your answer, but I don't have enough reputation.

Public - anonymously accessibly, but blocked for any traffic outside SPO (but still available for other tenant subscriptions outside of our own to access?)

Private - only available to authenticated users in my tenant? (+ all of the other rewrite rules, etc.)

Improve this answer
1
  • I talked with Vesa via Twitter and he confirmed the above. Also, I found good documentation in the "Choose whether each origin should be public or private" section here... support.office.com/en-us/article/…
    – kduenke
    Mar 1, 2018 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.