What Is a CDN?
Content Delivery Network — Architectural definition, operational mechanics, real-world examples, security posture, and client-side inspection utilities.
Web Protocols & Security Architecture Research
What Is a CDN?
Supporting Architectural Explanation
By caching copies of static files (images, CSS, JavaScript bundles, video files) on edge servers located physically close to end users, a CDN drastically reduces the physical distance signals must travel over fiber-optic networks, eliminating round-trip latency.
CDNs also provide origin server shielding, absorbing massive traffic spikes, mitigating Distributed Denial of Service (DDoS) attacks at the edge, and optimizing routing paths through private global fiber backbones.
Why does CDN exist?
Solves physical latency constraints by moving cached content to edge data centers within a few milliseconds of 95% of the world’s population.
In the early web, all users requested content from a single origin server in one location. A user in Tokyo connecting to a server in Virginia experienced 250ms+ latency per round trip due to the speed of light in fiber.
Solves physical latency constraints by moving cached content to edge data centers within a few milliseconds of 95% of the world’s population.
How does CDN work?
Clients resolve website domains to CDN edge nodes using Anycast DNS. The edge server inspects its local cache; on a cache HIT, it serves the file in <10ms; on a cache MISS, it fetches the file from the origin server, stores it according to Cache-Control headers, and delivers it.
Anycast DNS Resolution
Client resolves domain; BGP Anycast routes request to the topologically closest CDN Edge PoP.
Edge Cache Inspection
Edge node checks SSD/RAM cache for matching URL and cache key (URI, Accept-Encoding).
Cache HIT Delivery
If cached and fresh (TTL valid), file is returned immediately with `CF-Cache-Status: HIT`.
Origin Fetch & Store (Cache MISS)
If absent or expired, edge node fetches file from origin, caches it locally, and relays it to client.
How is CDN implemented in code?
HTTP/2 200 OK
Content-Type: application/javascript; charset=UTF-8
Content-Encoding: br
# 1. Hashed Static Assets (Immutable - never recheck origin for 1 year)
Cache-Control: public, max-age=31536000, immutable
# 2. Dynamic Content with Stale-While-Revalidate (Instant edge hit while updating in background)
# Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400
# CDN Debug Headers
CF-Cache-Status: HIT
Age: 4821
Server: cloudflareArchitectural Explanation: `s-maxage` dictates CDN edge retention, while `stale-while-revalidate` delivers stale copies instantly while edge asynchronously refreshes.
Where is CDN commonly used?
Delivering JavaScript bundles, web fonts, CSS stylesheets, and images for web apps.
Delivering HLS/DASH video segments for Netflix, YouTube, and Twitch without buffering.
Absorbing multi-terabit volumetric botnet attacks at the edge before traffic reaches origin servers.
What are the advantages and limitations of CDN?
Core Advantages
Sub-Millisecond TTFB
Delivers content from edge PoPs close to the user, slashing Time To First Byte (TTFB).
Origin Server Shielding
Caches absorb 85%-98% of inbound requests, reducing origin server CPU and database costs.
Global DDoS Absorption
Multi-terabit edge capacity absorbs volumetric layer 3/4/7 DDoS attacks effortlessly.
Architectural Limitations
Cache Invalidation Delays
Purging stale assets across thousands of global edge nodes can take seconds or minutes.
Dynamic Content Bypasses
Uncacheable personalized database queries must still travel all the way back to the origin.
Can CDN introduce security vulnerabilities?
Web Cache Poisoning
Attacker sends unkeyed HTTP headers (like `X-Forwarded-Host`) causing the CDN to cache malicious responses and serve them to all visitors.
Strip unkeyed headers at the edge or include custom headers in the CDN cache key configuration.
What are common misconceptions about CDN?
Modern CDNs run edge compute (Cloudflare Workers, Fastly Compute@Edge) executing dynamic code and database lookups directly at the edge.
Frequently Asked Questions About CDN
Q:What is the difference between max-age and s-maxage in Cache-Control?
This allows developers to instruct CDNs to cache an asset for 24 hours (`s-maxage=86400`) while telling client browsers to revalidate every 5 minutes (`max-age=300`).
12. Related Interactive Tools
Inspect, test, and verify this protocol directly in your browser with 100% private client-side execution:
13. Related Comprehensive Guides
Ecosistema Técnico Relacionado y Próximos Pasos
Preguntas Relacionadas
What Happens When a DNS TTL Expires?
Answer: When a DNS TTL expires, caching resolvers evict the record and must re-query the authoritative nameserver before responding to clients.
Can a CNAME Record Point to an IP Address?
Answer: No, RFC 1034 requires CNAME records to point exclusively to another domain name, never to raw IPv4 or IPv6 addresses.
Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?
Answer: RFC 1034 requires that if a CNAME exists at a node, no other record data may exist there. Since a zone apex must have SOA and NS records, CNAME is prohibited.
Laboratorios Prácticos de Diagnóstico
Especificaciones y Referencias Técnicas
Continuar Aprendiendo
DNS Resolution & Propagation Lab
Trace authoritative resolution from the root servers down to the zone file in the visual DNS workbench.