Chapter 23: CDN Deep Dive

What is a CDN?

Content Delivery Network (CDN): Distributed network of edge servers that cache content geographically close to users, reducing latency from 200ms+ to 20-50ms.

Core Components

• PoP (Point of Presence): Data center with edge servers in specific geographic location
• Edge Servers: Cache servers at PoPs serving content to nearby users
• Origin Server: Source of truth for content
• Anycast: Single IP routes to nearest PoP automatically

Latency Impact

CDN Architecture

Push vs Pull CDN

Push CDN

Content is pre-uploaded to CDN edge servers by origin. Origin controls when content is distributed.

• Origin pushes content to all edge locations
• Content available immediately when requested
• Good for infrequently changing content
• Examples: Software releases, static marketing sites

Pull CDN

CDN fetches content from origin on-demand when first requested. Lazy loading approach.

• First request fetches from origin (cache miss)
• Subsequent requests served from cache (cache hit)
• Content expires based on TTL
• Examples: User-generated content, dynamic sites

Comparison

Cache Hierarchy

Multi-tier caching reduces origin load and improves cache hit rates through cache promotion.

Tiers

1. Edge Cache: First tier, geographically closest to users (200+ locations)
2. Regional Cache: Second tier, consolidates edge misses (10-20 locations)
3. Shield Cache: Third tier, single point before origin (1-3 locations)
4. Origin Server: Source of truth, fallback for all cache misses

Multi-Tier Diagram

Cache Hit Rates by Tier

Benefits

• Origin Protection: Only 0.1-2% of requests reach origin
• Cache Warming: Regional caches warm edge caches faster
• Resilience: Multiple fallback layers
• Cost: Reduced origin bandwidth by 98%+

Origin Shielding

Origin Shield: Additional caching layer between regional caches and origin, consolidating all cache misses through single PoP.

Without Shield

With Shield

Impact

Use Cases

• Origin Protection: Prevents origin overload during traffic spikes
• Cost Reduction: Reduces origin bandwidth costs 90%+
• Dynamic Content: Caches API responses, personalized content
• Cache Warming: Shield acts as pre-warmed cache for all edges

Cache-Control Headers

HTTP headers control CDN caching behavior. Origin sets headers, CDN respects them.

Key Directives

Common Patterns

Expires Header (Legacy)

Expires: Wed, 21 Oct 2026 07:28:00 GMT

Older alternative to Cache-Control. Use Cache-Control instead (more flexible, no clock skew issues).

Invalidation Strategies

How to remove or update cached content before TTL expires.

Methods

Versioned URLs (Best Practice)

// Instead of invalidating:
/static/app.js
/static/styles.css

// Use versioned URLs:
/static/app.a3f2b9c.js
/static/styles.7d4e1f2.css

// Or query params:
/static/app.js?v=a3f2b9c
/static/styles.css?v=7d4e1f2

Invalidation Flow

Cache Tags Example

// Origin response:
Cache-Control: public, max-age=3600
Cache-Tag: user-123, profile-page, user-content

// Invalidate all content tagged with user-123:
POST /api/v1/purge
{
  "tags": ["user-123"]
}

// Invalidates:
// - /users/123
// - /users/123/posts
// - /api/users/123

CloudFront Invalidation

• Cost: First 1,000 paths/month free, $0.005 per path after
• Wildcards: /images/* counts as 1 path
• Time: 5-15 minutes to propagate globally
• Limit: 3,000 invalidations in progress per distribution

Dynamic Acceleration

CDN optimizations for uncacheable dynamic content (APIs, personalized pages, real-time data).

Techniques

1. Route Optimization

• Private Backbone: CDN routes traffic over optimized private network, avoiding congested public internet
• BGP Optimization: Real-time route selection based on network conditions
• Impact: 20-40% latency reduction vs public internet

2. TCP Optimization

• TCP Termination: Edge server terminates TCP with user, separate optimized connection to origin
• TCP BBR: Google's congestion control algorithm, better throughput
• TCP Fast Open: Send data in SYN packet (0-RTT)
• Impact: Eliminates slow-start, reduces handshake overhead

3. Connection Pooling

• Persistent Connections: Edge maintains warm connections to origin
• Multiplexing: HTTP/2 multiplexes requests over single connection
• Impact: Eliminates per-request TLS handshake (100-200ms saved)

4. Smart Compression

• Gzip/Brotli: Compress responses at edge (not origin)
• Delta Compression: Send only changes for repeated requests
• Impact: 60-80% size reduction, faster transfer

Dynamic Acceleration Flow

Performance Impact

Edge Computing

Run code at CDN edge servers for sub-10ms response times without origin roundtrip.

Comparison

Use Cases

• Authentication: Verify JWT at edge, block unauthorized requests
• A/B Testing: Route users to variants without origin roundtrip
• Personalization: Insert user data into HTML at edge
• Bot Detection: Block scrapers/bots before reaching origin
• Geo-Routing: Route based on user location
• Header Manipulation: Rewrite headers, add security headers
• Redirects: 301/302 redirects without origin
• Image Optimization: Resize/compress images on-demand

Cloudflare Worker Example

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  // Verify JWT at edge
  const token = request.headers.get('Authorization')
  if (!token || !await verifyJWT(token)) {
    return new Response('Unauthorized', { status: 401 })
  }

  // A/B test routing
  const variant = Math.random() < 0.5 ? 'A' : 'B'
  const url = new URL(request.url)
  url.hostname = variant === 'A' ? 'origin-a.com' : 'origin-b.com'

  // Fetch from origin
  const response = await fetch(url, request)

  // Add security headers
  const newResponse = new Response(response.body, response)
  newResponse.headers.set('X-Frame-Options', 'DENY')
  newResponse.headers.set('X-Variant', variant)

  return newResponse
}

Edge vs Serverless

Video CDN

Specialized CDN features for video streaming: adaptive bitrate, segment caching, live streaming.

Streaming Protocols

Adaptive Bitrate Streaming

Video encoded at multiple quality levels, player switches based on bandwidth.

Segment Caching

• Manifest Files: .m3u8 (HLS) or .mpd (DASH), lists video segments, low TTL (1-5s)
• Video Segments: .ts or .m4s files, 2-10s chunks, high TTL (1 day - 1 year)
• Byte-Range Requests: CDN caches full file, serves ranges on demand
• Prefetching: CDN prefetches next segments based on player behavior

Video CDN Architecture

Live vs VOD

Optimization Techniques

• Multi-CDN: Use multiple CDNs for redundancy, switch on failure
• Pre-Positioning: Upload popular content to edge before demand
• Tiered Caching: Shield origin from thousands of viewers
• Token Authentication: Signed URLs prevent hotlinking

CDN Security

CDNs provide security layers: DDoS mitigation, WAF, bot protection, origin cloaking.

Security Features

1. DDoS Mitigation

• L3/L4: SYN floods, UDP floods absorbed by CDN infrastructure
• L7: HTTP floods detected via rate limiting, CAPTCHA challenges
• Capacity: CDN PoPs absorb 10-100+ Tbps attacks
• Anycast: Distributes attack across all PoPs globally

2. Web Application Firewall (WAF)

• OWASP Top 10: Blocks SQL injection, XSS, CSRF, etc.
• Custom Rules: Block by IP, country, user-agent, headers
• Rate Limiting: Limit requests per IP/user
• Managed Rules: Pre-configured rulesets (AWS Shield, Cloudflare)

3. Bot Protection

• JavaScript Challenge: Render JS to prove real browser
• CAPTCHA: Challenge suspicious traffic
• Fingerprinting: Identify bots via TLS, HTTP/2 fingerprints
• Behavioral Analysis: Detect scraping patterns

4. Origin Cloaking

• Hide Origin IP: DNS points to CDN, origin IP not exposed
• Private VPC: Origin in private network, CDN connects via PrivateLink/VPN
• IP Allowlist: Origin only accepts traffic from CDN IPs

DDoS Mitigation Flow

WAF Rule Example

// Block SQL injection attempts
{
  "rule": "sql-injection-protection",
  "condition": "request.query contains 'union select' or request.body contains '1=1'",
  "action": "block"
}

// Rate limit API
{
  "rule": "api-rate-limit",
  "condition": "request.path starts with '/api/'",
  "action": "rate-limit: 100 req/min per IP"
}

// Geo-blocking
{
  "rule": "block-country",
  "condition": "request.country in ['CN', 'RU']",
  "action": "block"
}

Security Comparison

CDN Provider Comparison

Major Providers

Pricing Comparison (US/Europe)

Feature Matrix

When to Use Each

• CloudFront: Already on AWS, need tight S3/ALB integration, Lambda@Edge for complex logic
• Cloudflare: Cost-sensitive, need strong DDoS/security, Workers for edge compute, instant purge
• Fastly: Developer control, VCL customization, instant purge critical, high-performance APIs
• Akamai: Enterprise, mission-critical (99.999% SLA), largest network, China access