Users of a web service are distributed around the world, but the origin server sits in a specific region. Users in a distant region incur latency proportional to the physical distance.
A CDN (Content Delivery Network) is a service that caches content at edge locations around the world, delivering it quickly from the location closest to the user. Since responses come from the edge instead of going all the way to the origin server, latency drops significantly and origin load decreases as well.
sequenceDiagram
participant User as User
participant Edge as CDN Edge
participant Origin as Origin Server
User->>Edge: Request
alt Cache hit
Edge-->>User: Immediate response (fast)
else Cache miss
Edge->>Origin: Origin request
Origin-->>Edge: Response + caching
Edge-->>User: Response
end
The server holding the original content. Object storage, a VM, a load balancer, etc.
Edge/PoP
A cache server close to the user. Hundreds of locations worldwide
Cache hit/miss
A hit (fast) if content is at the edge; a miss (fetched from origin) if not
TTL (Time To Live)
The cache’s valid duration. Refetched from origin once it expires
Cache invalidation
Forcibly deletes a cache entry before its TTL expires. Propagating this globally takes time
Cloud CDNs recommend HTTPS by default, with a free TLS certificate provided as an integrated feature, so you can apply SSL/TLS without purchasing a separate certificate. HTTP is also supported, but an HTTPS-only configuration is recommended for security.
AWS CloudFront — Has a high number of edge locations, and Lambda@Edge/CloudFront Functions let you run code at the edge. Origin Shield can further reduce origin load.
Azure Front Door — Unifies CDN, a global load balancer, and WAF into a single service. You can manage all traffic with Front Door alone, without separate CDN configuration.
Google Cloud Cloud CDN — Configuration is simple, enabled with a single checkbox on Cloud Load Balancing. Cache invalidation propagates within seconds.
OCI — Instead of its own CDN service, it supports global distribution through partnerships with specialized CDNs like Akamai and Fastly. Edge Services provides WAF and DDoS protection.
A CDN caches content to deliver it quickly, but workloads that can’t be cached (game servers, IoT, real-time APIs) need a network accelerator. An accelerator terminates the TCP/TLS connection at the edge without caching and forwards it to the origin over the vendor backbone network to reduce latency.
Setting a long TTL on index.html — Users keep receiving the old HTML even after static file hashes change. Give index.html a short TTL (a few minutes), and run other static files with hashed filenames + a long TTL.
Using cache invalidation as part of the deployment routine — Global propagation takes time and costs money. Hashed filename strategy is the right answer.
Applying CDN caching to an API that requires authentication — Another user’s private data could be returned from the cache. Explicitly set Cache-Control: no-store or include the auth token in the cache key.