CDN and edge

Deep dive

Provider map

Decision table

Code

Cache headers decide everything. Hashed assets cache forever; HTML revalidates; APIs use short TTLs with stale serving:

location ~* \.(js|css|woff2|png|webp|avif)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
}
location = /index.html {
    add_header Cache-Control "public, max-age=0, must-revalidate";
}
location /api/leaderboard {
    # CDN keeps it 30 s, serves stale for 5 min while refetching or if the origin is down
    add_header Cache-Control "public, s-maxage=30, stale-while-revalidate=300, stale-if-error=86400";
    add_header Vary "Accept-Encoding";
    proxy_pass http://app;
}

Lock the origin so only the CDN can reach it (Cloudflare ranges example; or use mTLS / a secret header):

for cidr in $(curl -s https://www.cloudflare.com/ips-v4); do
  nft add rule inet filter input ip saddr $cidr tcp dport 443 accept
done
nft add rule inet filter input tcp dport 443 drop

Efficiency

• Cost: a hit costs the PoP a cache lookup and a send; a miss adds one origin fetch. The bill is GB served times the per-GB price plus requests, and latency is bound by the client-to-PoP round trip. Cloudflare Workers bill $0.30 per additional million requests and $0.02 per additional million CPU ms above the included amounts, with no charge for duration (Workers pricing, as of 2026-10).
• Levers:
  • long TTL with content-hashed names (immutable) — hit ratio toward the 90-99 % in Key facts (order of) — static assets
  • tiered cache / origin shield — lower tiers ask an upper tier before the origin, so fewer origin requests (Cloudflare Tiered Cache docs) — many PoPs, one origin
  • stale-while-revalidate and stale-if-error — hide origin latency and outages (RFC 5861) — APIs, leaderboards
  • no Set-Cookie, no private on cacheable routes — Cloudflare does not cache responses that have them (Cloudflare default cache behavior) — cacheable routes
  • zero-egress origin such as R2 — no egress bandwidth charge (R2 pricing, as of 2026-10) — origin on Cloudflare
• Naive → standard → state of the art:
  • no CDN · every request pays the full RTT and origin egress
  • CDN with TTLs and hashed filenames · hits from the nearest PoP, the origin sees misses only
  • tiered cache, stale serving, purge by tag · about one origin request per object per TTL (order of)

Implementation notes

• Cache key = URL + selected headers. Strip tracking query params and avoid Vary: User-Agent, or the hit ratio collapses.
• Content-hash filenames (app.3f9c1a.js) make purges unnecessary for assets.
• Origin shield / tiered cache: one regional PoP fetches from the origin for all others; cuts origin load 5-20x.
• Compress at the edge (Brotli for text); serve AVIF/WebP via image resizing services.
• Measure with response headers (cf-cache-status, x-cache, age) and keep a hit-ratio dashboard.

Pitfalls

• Set-Cookie on a response makes most CDNs refuse to cache it.
• Caching authenticated responses by accident (missing private) leaks one user's data to another.
• Cloudflare's self-serve plans restrict serving mostly video or large binaries outside their media products; read the service terms before moving TBs.
• Edge functions with per-request origin fetches can be slower than the origin alone if the origin is far and uncached.
• Purge-everything on deploy causes an origin stampede; purge by tag/path.

Implementations

Sources

• Erik Nygren, Ramesh Sitaraman, Jennifer Sun, The Akamai Network: A Platform for High-Performance Internet Applications, ACM SIGOPS OSR, 2010. paper
• RFC 9111, HTTP Caching, 2022. rfc · RFC 5861, HTTP Cache-Control Extensions for Stale Content, 2010. rfc
• Cloudflare, Cache documentation. docs · AWS, Amazon CloudFront pricing. pricing