WAF: add directory based hmac example

[Le0Developer]

Summary

This summary is Copilot generated

This pull request adds documentation for a new use case to the custom token authentication rules, specifically describing how to protect an entire directory with a single HMAC signature. The update provides a practical example and step-by-step instructions for extracting a directory name from a request URI and using it in authentication.

New use case documentation:

• Added a section explaining how to protect an entire directory with a single signature by concatenating the directory name and query string as the MessageMAC argument for the is_timed_hmac_valid_v0() function.
• Included an example using the substring() function to extract a fixed-length directory name from the URI path and demonstrated how to construct the authentication logic using concat() and the relevant WAF functions.

Screenshots (optional)

Documentation checklist

• Is there a changelog entry (guidelines)? If you don't add one for something awesome and new (however small) — how will our customers find out? Changelogs are automatically posted to RSS feeds, the Discord, and X.
• The documentation style guide has been adhered to.
• If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
• Files which have changed name or location have been allocated redirects.

[Le0Developer]

I don't think case-studies will be a common example. I think image/video delivery (where one album/HLS playlist shares the same token) are a lot more common. This was sparked by a discussion in the #r2 channel on Discord.

[pedrosousa]

I don't think case-studies will be a common example. I think image/video delivery (where one album/HLS playlist shares the same token) are a lot more common. This was sparked by a discussion in the #r2 channel on Discord.

Hi @Le0Developer
I discussed this internally and ended up using case-studies due to the following reasons:

• Using images as an example could lead to a user creating a configuration that would leak information. If a user follows the example but keeps photos/files of all users under the same path prefix (or in sub-folders of that prefix), a single auth token could be used to access any user's photo if we can guess filenames.
• Using videos would require additional Cloudflare products or subscriptions (R2 or Stream), and I was trying to make the example generic enough so it applied to more users (even though HMAC validation requires a Pro, Business, or Enterprise plan).

[holopin-bot]

Congratulations @Le0Developer, the maintainer of this repository has issued you a holobyte! Here it is: https://holopin.io/holobyte/cmeu4935k1728707i89l8qmo5u

This badge can only be claimed by you, so make sure that your GitHub account is linked to your Holopin account. You can manage those preferences here: https://holopin.io/account.
Or if you're new to Holopin, you can simply sign up with GitHub, which will do the trick!