Content Delivery Network (CDN)

A Content Delivery Network (CDN) is a geographically distributed network of Points of Presence (PoPs), each containing edge servers that cache content and serve it to nearby users. CDNs reduce latency, offload origin servers, and improve availability.

How CDN routing works:

1. Your DNS CNAME record points to the CDN provider’s DNS (e.g., d1234.cloudfront.net)
2. The CDN’s anycast or GeoDNS returns the IP of the nearest PoP
3. The edge server checks its cache for the requested object
4. On a cache miss, the edge fetches from the origin (your server) and caches the response
5. Subsequent requests are served from cache until TTL expires (cache hit)

Cache control headers that govern CDN behavior:

Header	Example	Effect
Cache-Control: max-age=31536000, immutable	Static assets	Cached for 1 year, never revalidated
Cache-Control: s-maxage=300	API responses	CDN caches for 5 min, ignores client max-age
Cache-Control: no-store	User dashboards	CDN never caches
Surrogate-Control: max-age=600	Fastly/Varnish-specific	CDN-only TTL, stripped before client
Vary: Accept-Encoding	Compressed assets	CDN stores separate copies per encoding

Origin pull vs. origin push:

• Pull (most common): CDN fetches content on the first cache miss, caches it automatically
• Push: you explicitly upload assets to the CDN storage (used for large files, video)

CDN layers of value:

• Performance: edge caching, TCP connection reuse, HTTP/3 (QUIC), Brotli compression
• Resilience: traffic absorbs at the edge during origin failures; many CDNs offer origin failover
• Security: DDoS absorption, TLS termination at the edge, WAF integration, bot management
• Edge compute: run serverless functions at PoPs (Cloudflare Workers, Lambda@Edge)

# Inspect CDN cache status from response headers
$ curl -sI https://example.com/assets/logo.png
HTTP/2 200
x-cache: Hit from cloudfront
x-cache-hits: 42
age: 1823
cache-control: max-age=31536000, immutable
cf-cache-status: HIT          # Cloudflare variant
x-served-by: cache-sjc-ksjc7920-SJC  # PoP that served the response

# Force cache revalidation
$ curl -sI -H "Cache-Control: no-cache" https://example.com/assets/logo.png
x-cache: Miss from cloudfront

# Purge a URL from Cloudflare cache via API
$ curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/purge_cache" \
  -H "Authorization: Bearer $CF_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://example.com/assets/logo.png"]}'

# Nginx origin: set CDN-friendly cache headers
location /assets/ {
    # Cache static assets for 1 year at CDN and browser
    add_header Cache-Control "public, max-age=31536000, immutable";
    # Separate CDN copy per encoding
    add_header Vary "Accept-Encoding";
}

location /api/ {
    # CDN caches for 60s; browser does not cache
    add_header Cache-Control "public, s-maxage=60, max-age=0";
}

location /dashboard/ {
    # Never cache authenticated content
    add_header Cache-Control "private, no-store";
}