Content Delivery Network (CDN)
A system of distributed servers that deliver web content to users based on their geographic location.
Detailed Explanation
CDNs (like Cloudflare, Akamai, or Fastly) cache static assets at the 'edge' of the network. By serving an image from a server in London to a user in London, instead of fetching it from a server in New York, the CDN drastically reduces latency. Modern CDNs also handle security (WAF), image optimization, and even serverless code execution.
Quick Summary
A CDN puts copies of your content on servers near your users, so requests don't traverse the planet. Modern CDNs also do TLS termination, WAF, image transformation, and edge compute, they've quietly become application platforms.
Key Takeaways
- Edge nodes cache responses keyed by URL and Vary headers; cache-control headers govern TTLs.
- Cache hierarchy: edge → regional → origin. Each layer absorbs load and reduces origin traffic.
- Static assets are easy. Dynamic content benefits via edge compute (Workers, Edge Functions) and HTML streaming.
- Cache invalidation strategies: TTL expiry, surrogate keys (Fastly), explicit purges, content-hashed URLs.
- Major CDNs: Cloudflare, Fastly, Akamai, CloudFront, BunnyCDN, plus cloud-native (Google CDN, Azure Front Door).
When to use it
- Serving static assets (images, JS, CSS, video) close to users.
- Edge TLS termination and HTTP/3 support without changes to your origin.
- WAF, bot management, and DDoS absorption at the edge.
- Edge compute for personalization, A/B testing, auth gates, and ISR-style rendering near users.
Common Mistakes
- Forgetting `Vary` headers; the CDN serves the wrong cached response to users with different Accept-Language or device types.
- Hardcoding origin URLs in HTML/CSS, assets aren't served through the CDN, defeating the point.
- Cache-busting via query strings everywhere; bypass caching entirely and you pay origin every request.
- Trusting the CDN as security boundary while leaving the origin publicly reachable; attackers bypass the CDN.
Content Delivery Network (CDN), Frequently Asked
How do I invalidate the cache?
Three patterns: (1) content-hashed URLs (`app.abc123.js`), the cleanest, change file → change URL. (2) Short TTLs + revalidation headers. (3) Explicit purges via API, useful for emergencies but slow at scale. Use #1 for assets, #2 for HTML, #3 only when needed.
Should I lock my origin to my CDN?
Yes, for production. Otherwise attackers can DDoS or bypass WAF by hitting the origin directly. Use CDN-issued IP allowlists, mTLS, or hostname-shielding features.