Recap — CDN Patterns and When to Use Edge

# CDN Patterns and When to Use Edge A CDN (Content Delivery Network) is a global network of servers that cache content near users. Cuts latency, offloads origin servers, costs less than hosting it all yourself. ## How CDNs work ``` User in Mumbai requests image.jpg → DNS resolves to nearest CDN edge (Mumbai POP) → Edge has cache hit → serves immediately (10ms) → Edge has miss → fetches from origin → caches → serves (100ms first time, 10ms after) ``` Major CDNs in 2026: Cloudflare, Fastly, Akamai, AWS CloudFront, Bunny, Vercel Edge. ## What to put on a CDN ### Static assets (the obvious) - Images, videos, CSS, JavaScript bundles. - Documents (PDFs, downloads). - HTML for static sites. ### Cacheable API responses - Public data (product catalog, public profiles). - Aggregations updated infrequently. - Use proper cache headers. ### Streaming media - Video chunks (HLS, DASH segments). - Live streams (with low-latency CDN config). ### NOT on CDN - User-specific responses (unless varied by user, which kills cache). - Real-time data (stock prices, live feeds without delay tolerance). - Sensitive data without proper auth. ## Cache headers (control what CDN does) Origin sets these; CDN respects them: ```http Cache-Control: public, max-age=3600 ETag: "abc123" ``` Key headers: - **Cache-Control: public/private** — can shared caches store this? - **max-age=N** — seconds to keep cached. - **s-maxage=N** — overrides max-age for shared caches (CDN-specific). - **stale-while-revalidate=N** — serve stale up to N seconds while fetching fresh. - **Vary: Accept-Encoding** — separate caches per encoding. ## Cache invalidation on CDN When content changes: - **TTL expiry**: wait for max-age to pass. - **Purge by URL**: API call to invalidate a specific URL. - **Purge by tag**: tag content; purge all tagged with X. - **Cache busting**: rename file (`app.v2.js` instead of `app.js`); old URL stays cached but unused. For frequently-changing critical content: short TTL + purge on update. For asset versioning: cache forever with versioned filenames; deploy new version = new URLs. ## Cache key What makes responses uniquely cacheable. Default: URL + method. Vary headers extend the key. `Vary: Accept-Encoding` means separate gzip and brotli caches. Don't include user-specific things in cache key by accident (cookies, auth headers). Or response becomes per-user, defeating CDN. ## Edge compute Beyond static caching, CDNs run code at the edge: - **Cloudflare Workers** - **Fastly Compute@Edge** - **AWS Lambda@Edge** - **Vercel Edge Functions** Use cases: - A/B testing without round-trip to origin. - Auth checks (JWT validation) at edge. - Personalization with edge-cached templates. - Image transformations on-the-fly. - API gateway logic. Edge compute trades server flexibility for ultra-low latency. ## CDN as DDoS protection CDNs absorb traffic spikes: - Cached content served from edge (origin sees little). - Rate limiting at edge. - WAF (web application firewall) blocks malicious traffic. - Bot detection. Major CDNs (Cloudflare especially) double as DDoS mitigation. ## Cost considerations CDN pricing models: - **Per-GB transferred** (most common; tiered). - **Per-request** (sometimes). - **Bandwidth pricing** at origin → CDN. Caching reduces origin bandwidth dramatically (1% hit rate = 99% saved at origin). Big cost win at scale. Free tiers (Cloudflare free) work for small sites; production traffic costs scale up. ## Common CDN mistakes 1. **No cache headers.** CDN doesn't cache anything; defeats the purpose. 2. **Caching auth-protected content.** Logged-in users see other users' content. 3. **No cache invalidation strategy.** Stale content for hours after updates. 4. **Caching with cookies in the key.** Effectively per-user caching — no CDN benefit. 5. **CDN for dynamic content without thought.** Real-time data shouldn't be cached. ## Takeaway CDN = edge cache for static and cacheable content. Cuts latency (users hit nearby POP); reduces origin load; provides DDoS protection. Cache headers (Cache-Control, max-age, s-maxage, stale-while-revalidate) control behavior. Invalidate via TTL, purge API, or cache-busting URLs. Edge compute runs code at POPs for ultra-low latency. Don't cache user-specific or real-time content.