Technology · Edge delivery
CDNs and Edge Delivery
Content delivery networks terminate TLS, cache static and dynamic assets at edge points of presence, and protect origins with shielding and signed URLs.
10 min read
A Content Delivery Network (CDN) is a geographically distributed network of proxy servers and data centers (Points of Presence, or PoPs). By terminating TCP/TLS connections and caching web assets close to end users, a CDN cuts latency from hundreds of milliseconds to under 25 ms while shielding origin application servers from massive traffic spikes.
When to reach for it
- Static media distribution: Images, videos, stylesheets, JavaScript bundles, downloads, and fonts.
- Global latency reduction: Serving users worldwide from nearby PoPs via BGP Anycast routing rather than forcing all traffic across transoceanic fibers to a single central origin.
- Origin protection and DDoS absorption: Absorbing massive traffic surges and volumetric DDoS attacks at edge capacity without touching origin infrastructure.
- Edge computing and security: Running authentication, header rewrites, bot detection, geo-routing, and Web Application Firewall (WAF) inspections before requests touch backend services.
How edge caching works
- Anycast DNS & BGP routing: A single IP address is announced simultaneously from hundreds of data centers globally. Internet routers automatically route the user's packet to the topologically nearest edge PoP.
- TLS termination at the edge: The edge PoP completes the TLS handshake in 10–20 ms. The slow TLS negotiation and TCP slow-start occur across short local loops rather than a 150 ms transoceanic hop.
- Cache lookup: The PoP hashes the request into a cache key (path, query parameters, headers).
- Hit vs Miss: On a cache hit, the file streams from edge memory or NVMe storage immediately. On a cache miss, the CDN fetches the asset from an upstream origin shield or origin server, stores a copy, and returns the response.
Cache keys and HTTP caching headers
A CDN determines what to cache, how long to hold it, and when to revalidate based on standard HTTP response headers:
s-maxage vs max-age
- s-maxage applies only to shared caches (CDNs)
- max-age controls browser client cache
- Forgetting s-maxage causes CDNs to inherit client TTLs
Pick it when: Tuning edge caching separately from browser caching (e.g. s-maxage=86400, max-age=3600).
stale-while-revalidate
- Serves cached stale content instantly while updating in background
- Completely eliminates user-facing cache miss latency
- Users see slightly stale content for one request
Pick it when: Semi-dynamic content: home pages, trending feeds, product reviews.
Vary header
- Tells CDN to include specific request headers in the cache key
- High cardinality headers (User-Agent, Cookie) ruin hit ratios
Pick it when: Serving different representations (Vary: Accept-Encoding for gzip/br, or Vary: Accept for webp/avif).
Invalidation and cache tags
Relying purely on TTL expiration causes updates to lag. Modern CDNs offer two invalidation mechanisms:
- Purge by URL / Wildcard: Deleting a specific path (
/images/logo.png) or pattern (/static/v2/*). Propagation takes seconds to minutes across global PoPs. - Surrogate keys / Cache tags: Origins tag responses with custom headers (such as
Surrogate-Key: product-123 merchant-45). When product 123 changes, the origin fires a single API call purging the tagproduct-123, instantly invalidating product pages, search card snippets, and catalog thumbnails across the globe in a single request.
Origin shielding and tiered caching
In a global network with 200+ PoPs, an asset that expires simultaneously across all PoPs can trigger 200 concurrent requests to the origin for the same file (the thundering herd at the edge).
An Origin Shield is a designated high-capacity regional PoP situated directly in front of the origin. All edge PoP misses route through the shield first. The shield absorbs identical misses, coalesces concurrent fetches, and ensures only a single request hits the origin backend to refresh the asset.
Private content: signed URLs and signed cookies
When content is private (paid video streams, private documents, member-only files), the CDN must authenticate requests before serving cached bytes:
- Signed URLs: The application server generates a temporary URL containing HMAC query parameters (
Expires=1697500000&Signature=...&Key-Pair-Id=...). The CDN verifies the cryptographic signature at the edge using a shared public key, serving cached bytes if valid and rejecting expired requests without contacting origin servers. - Signed cookies: Instead of signing individual file URLs, an HMAC cookie grants access to an entire directory path (e.g.
/courses/system-design/*), ideal for HLS video streaming where players fetch hundreds of separate video chunks.
Dynamic acceleration and edge compute
CDNs are no longer just static asset caches. They optimize dynamic API traffic and execute serverless code at the edge:
- Dynamic site acceleration (DSA): For uncacheable POST and GET requests, CDNs maintain persistent, pre-warmed TCP/TLS connection pools across optimized private backbones to the origin, bypassing public internet routing congestion.
- Edge computing (Cloudflare Workers, Fastly Compute, Lambda@Edge): Running lightweight JavaScript or WebAssembly directly inside the edge PoP. Used for A/B test routing, geolocation redirection, JWT authentication checks, and header mutations in sub-5ms compute times.
Numbers to quote
- Latency reduction
- 10–25 ms from edge PoP vs 100–250 ms cross-continent origin fetch
- Static hit ratio
- 95–99% for properly configured static assets
- Dynamic API hit ratio
- 60–85% with micro-caching (stale-while-revalidate 10s)
- Purge propagation time
- 150 ms to 5 seconds on modern providers (Fastly, Cloudflare)
- Bandwidth egress cost
- typically 50–70% cheaper than cloud provider raw egress
Where it bites
- Caching authenticated private data: If an origin returns private user data (like
/api/me) withCache-Control: public, the CDN will store it and serve user A's private profile to user B. Always enforceCache-Control: private, no-storeon authenticated endpoints. - Long purge latency on legacy CDNs: If a bad JavaScript release is deployed, older CDNs can take 15–30 minutes to purge globally. Always combine CDNs with content-hashed filenames (
main.a8b1c4.js) so new deployments never depend on cache invalidation. - Origin downtime on cache stampedes: If a popular multi-gigabyte video or game patch goes viral and origin shielding is disabled, hundreds of edge PoPs will miss simultaneously and crush the origin network link.
Try it
Content Delivery Network HLD
Design a globally distributed content delivery network with edge PoPs and origin shielding.