A CDN (Content Delivery Network) distributes content to geographically distributed servers ("edge" or "POP"—Point of Presence). Users fetch from the nearest edge node, cutting latency from 100+ ms to 10 ms.
What to Cache on the Edge
Good Candidates: Static, Immutable
- Images, CSS, JavaScript bundles (versioned: app-v1.2.3.js).
- Videos, PDFs, downloads.
- Public API responses (user profiles, product listings).
Why: No invalidation needed. Serve for years.
Bad Candidates: Dynamic, User-Specific
- HTML pages (if you change them often).
- User-specific dashboards.
- Real-time data (stock prices, live feeds).
- Authenticated content (requires session management).
Why: Invalidation is hard. Stale content causes user confusion.
Cache Keys and Versioning
Problem: You deploy app.js v2 but the edge still serves v1.
Solution: Content-based versioning.
OLD: /static/app.js
→ Easy to invalidate, but hard to manage.
→ Browsers cache for a year. Update is slow.
NEW: /static/app-a3f2b1c9.js (hash of content)
→ Same content = same URL.
→ Different content = different URL.
→ Browsers see new URL, fetch new content.
→ No invalidation needed; old version lives forever.
Strategy: Version your static assets in the build step (Webpack, Vite, etc.). New deploys automatically invalidate via new URLs.
Cache Invalidation
Sometimes you must invalidate (e.g., image hotfix, or metadata change).
Purge / Invalidation API
POST /purge
URLs: [
/images/profile/123.jpg,
/api/user/123
]
CDN removes these from all edge nodes.
Next request fetches from origin.
Cons: Expensive operation (broadcast to all edges, can take minutes). Use sparingly.
TTL-Based Expiration
Cache-Control: max-age=3600 (1 hour)
After 1 hour, edge re-validates from origin:
If origin hasn't changed (304 Not Modified), edge re-uses cached copy.
If changed, edge fetches new content.
Practical: Most teams set short TTLs (5 min - 1 hour) for dynamic content, long TTLs (1 year) for versioned static.
Signed URLs and Private Content
Problem: User-specific content (private photos). Can't cache publicly.
Solution: Signed URLs.
User logs in:
App generates signed URL:
/images/private/photo.jpg?expires=1700000000&signature=abc123
Signature = HMAC(secret_key, URL + expiry)
CDN checks signature before serving:
If valid and not expired: serve from cache or origin.
If invalid or expired: 403 Forbidden.
Benefit: Cache the same URL (one cached copy per user-specific object), but only authenticated users with valid signatures get through.
Implementation:
- S3 pre-signed URLs are a built-in example.
- CloudFront (AWS CDN) supports signed URLs natively.
Edge Functions / Serverless at the Edge
Modern CDNs (Cloudflare Workers, AWS Lambda@Edge, Vercel Edge Functions) let you run code at the edge.
Use cases:
- Rewrite URLs (e.g., /old → /new).
- Add headers (e.g., geolocation-based, security headers).
- A/B testing (serve variant A to 50%, variant B to 50%).
- Rate limiting at the edge (early denial).
Example:
// Cloudflare Worker
export default {
async fetch(request) {
const url = new URL(request.url);
// Geolocation redirect
const country = request.headers.get('cf-ipcountry');
if (country === 'CN') {
url.pathname = '/cn' + url.pathname;
}
// Fetch from origin
return fetch(url);
}
}
Global Edge Network Mental Model
User in Tokyo:
1. Requests image from CDN.
2. Nearest edge (Tokyo PoP) has it cached.
3. Serves from cache (~10 ms).
User in New York:
1. Requests same image.
2. Nearest edge (New York PoP) checks cache.
3. If not cached locally: fetches from parent edge or origin.
4. Caches locally.
Result: Users see sub-50-ms latency globally. Origin is unloaded.
In the interview
-
What to cache: Static, immutable, public content. Versioned assets (app-v1.2.3.js) have infinite TTL.
-
Invalidation: Use versioned URLs to avoid invalidation. Use short TTLs for dynamic content (5 min - 1 hour).
-
Private content: Signed URLs let you cache and authenticate (S3, CloudFront).
-
Edge computing: Rewrite, redirect, rate-limit at the edge. Massive latency win.
-
Tradeoff: CDN adds complexity and cost. Use when latency to origin is the bottleneck (global traffic, or origin is far).