CDN (Content Delivery Network)

• CDN (Content Delivery Network) : a geographically distributed network of edge servers that cache static and cacheable content close to end users.
• Edge server : a CDN node in a specific geographic region that serves cached content to nearby users.
• TTL (time-to-live) : the duration an object stays cached at an edge before it must be re-fetched from the origin.
• Cache key : the identifier (usually the URL) that determines what counts as the same cached object.
• Invalidation : removing stale content from the edge before the TTL expires, either by explicit purge or versioned URLs.
• Signed URL : a time-limited, tamper-proof link that restricts access to authorized users.

What is a CDN and why do we need it?

A content delivery network is a geographically distributed network of edge servers that cache static, cacheable content close to end users. The fundamental benefit is proximity: network latency grows with distance, so serving a file from an edge a few milliseconds away rather than an origin hundreds of milliseconds away makes an app feel instant, while simultaneously sparing the origin and cutting bandwidth cost.

How does CDN caching work?

When an edge does not have a requested file, it fetches it from the origin once, stores it, and serves all subsequent requests from its cache until the TTL expires. This is why the origin load drops dramatically: it serves each file once per edge per expiry period rather than once per user.

package com.bank.cdn;

public class EdgeCacheLogic {
    public byte[] serve(String url) {
        CacheEntry entry = edgeCache.get(url);
        if (entry != null && !entry.isExpired()) {
            return entry.body();                      // edge HIT
        }
        byte[] body = origin.fetch(url);              // MISS -> origin
        edgeCache.put(url, new CacheEntry(body, ttlSeconds));
        return body;
    }
}

What is the cache key and why does it matter?

The cache key decides what counts as the same object. By default it is the URL, but it can include query strings or headers when content varies. You must be careful that a cache key does not accidentally serve one user's personalized content to another, which would be a serious privacy breach in banking.

package com.bank.cdn;

public class CacheKeyExamples {
    // SAFE: static assets use URL as cache key
    // /static/logo.png -> same for all users

    // DANGEROUS: personalized content with no user in the key
    // /api/balance -> could serve Rajesh's balance to Priya!

    // CORRECT: add user token to cache key for personalized content
    // /api/balance?token=abc123 -> unique per user
}

How do you invalidate cached content?

Two approaches exist. Explicit invalidation requests purge a path from all edges, but this has cost and propagation delay. Versioned URLs give a changed file a new name like logo-v2.png so clients request a new, uncached object. Versioned URLs are generally preferred because they avoid the delay and cost of purging.

package com.bank.cdn;

public class InvalidationApproaches {
    // Approach 1: Explicit purge (slow, costly)
    public void purge(String path) {
        cdn.invalidate("/static/logo.png"); // propagates to 400+ edges
    }

    // Approach 2: Versioned URL (preferred)
    // Old: /static/logo.png
    // New: /static/logo-v2.png  -> new URL, no purge needed
    public String versionedUrl(String file, int version) {
        return "/static/" + file + "-v" + version + ".png";
    }
}

What content should and should not be on a CDN?

Cache content that is identical for every user: images, stylesheets, scripts, fonts, and video segments. Dynamic, personalized content like a specific account balance should not be cached at the edge, or must use a very short TTL and a cache key that isolates each user.

How do signed URLs protect private content?

Signed URLs grant time-limited access so only authorized users fetch premium or private content. The URL contains a signature that the CDN verifies; if the signature is missing, expired, or tampered with, the request is rejected.

package com.bank.cdn;

import java.time.Duration;
import java.time.Instant;

public class SignedUrlExample {
    public String createSignedUrl(String path, Duration validity) {
        Instant expiry = Instant.now().plus(validity);
        String signature = hmac(path + expiry.toString(), secretKey);
        return path + "?expires=" + expiry.getEpochSecond()
             + "&sig=" + signature;
    }
}

How does a CDN help with security and DDoS protection?

Because the CDN's distributed edge network can absorb volumetric traffic far better than a single origin, it doubles as denial-of-service protection. Attackers must overwhelm hundreds of edge servers instead of one origin. Many CDNs also integrate with Web Application Firewalls (WAF) for request filtering.

What should a senior engineer know?

A senior engineer knows that CDNs accelerate even uncacheable dynamic API traffic because requests travel over the CDN provider's optimized backbone from the edge to the origin with persistent connections, cutting round-trip latency. They also know to set proper Cache-Control headers so the CDN respects the intended caching behaviour, and to monitor cache hit ratios to ensure the CDN is actually offloading the origin effectively.