Skilled Coder Blog
Twitter
|
Newsletter
Technology Explained

How a CDN Works from Start to Finish

  1. You open a website like example.com and your browser starts loading assets (HTML, CSS, JS, images, fonts, videos).

  2. The website’s DNS is configured to use a CDN provider (e.g., Cloudflare, Akamai, Fastly) for static content.

  3. When your browser requests a file like /assets/logo.png, the DNS resolves to a CDN edge server IP instead of the origin server.

  4. The CDN uses Anycast routing - your request is routed to the nearest CDN edge server (based on geography, latency, and server load).

  5. The edge server checks its local cache:

    a. If the file is cached (a cache hit), it returns the file instantly.

    b. If it’s not cached (a cache miss), it makes a request to the origin server to fetch it.

  6. Once fetched, the edge server:

    a. Sends the file to your browser.

    b. Stores a local cached copy for future users nearby.

  7. Each cached file has a TTL (Time To Live), based on HTTP headers (Cache-Control, Expires, etc.) or CDN configuration.

  8. Until TTL expires:

    a. Future users near that edge server get super-fast responses.

    b. The origin server doesn’t get hit again.

  9. When TTL expires:

    a. The edge server may revalidate with the origin using conditional GET requests (If-Modified-Since, ETag) to check if the content changed.

    b. If not changed → cached version is reused (cheap revalidation).

    c. If changed → edge server fetches and caches the new version.

  10. If the file is frequently requested from multiple regions:

    a. The CDN automatically distributes it to other edge locations.

  11. CDNs also do TLS termination - HTTPS requests are decrypted at the edge, not at the origin, reducing CPU load on your servers.

  12. They support compression (gzip, Brotli) and image optimization on the fly to reduce payload size.

  13. Advanced CDNs can do:

    a. Edge logic / edge computing - run custom logic right at the edge (e.g., Cloudflare Workers).

    b. Dynamic content caching (with cache rules or key-based strategies).

    c. WAF, rate limiting, DDoS protection - security right at the edge before it hits your app.

  14. You can purge the cache manually or via API if you deploy updates and want to force a fresh fetch.

  15. All of this results in:

    • Lower latency for users (faster loads).
    • Less load on your origin server.
    • Better global performance.
    • Protection from spikes and attacks.
NOTE: The content below is additional technical knowledge and not necessary for basic understanding. Feel free to stop here if you're looking for just the essential process.

Why CDNs Are Essential for Modern Websites

Content Delivery Networks have become a critical component of web infrastructure because they address several fundamental challenges:

  • Geographic Distance: Physics imposes latency based on distance; CDNs bring content closer to users
  • Bandwidth Costs: CDNs can significantly reduce origin server bandwidth costs
  • Scalability: Handle traffic spikes without upgrading your infrastructure
  • Availability: Improve uptime by distributing content across redundant networks

Several companies dominate the CDN landscape, each with unique offerings:

  • Cloudflare: Known for security features and developer-friendly edge computing
  • Akamai: One of the oldest and largest CDNs with extensive global coverage
  • Fastly: Popular for real-time purging and edge computing capabilities
  • Amazon CloudFront: Deeply integrated with AWS services
  • Google Cloud CDN: Leverages Google’s global network infrastructure

Understanding how CDNs work allows developers and organizations to make informed decisions about content delivery strategies and optimize their web applications for global audiences.

CDN Technical Deep Dive

Network Architecture

CDN networks are built on sophisticated global infrastructures:

  1. Points of Presence (PoPs):

    • Physical data centers strategically located worldwide
    • Typically 50-1000+ locations depending on the CDN provider
    • Concentrated in high-population areas and internet exchanges
    • Each PoP contains multiple edge servers

  2. Anycast Routing:

    • Same IP address advertised from multiple locations
    • BGP routing directs requests to nearest advertising location
    • Provides automatic failover if a location becomes unavailable
    • Traffic engineering through route prefix announcements

  3. Peering Relationships:

    • Direct connections with ISPs and network providers
    • Private Network Interconnects (PNIs) for better performance
    • Reduces hops between client and edge server
    • Often leverages Internet Exchange Points (IXPs)

  4. Backbone Networks:

    • Private fiber connections between PoPs
    • Optimized routes that may outperform public internet
    • Dedicated capacity for origin-to-edge communication
    • Software-defined networking for dynamic traffic management

Cache Hierarchies

Modern CDNs implement multi-layered caching strategies:

  1. Edge Caches:

    • First line serving directly to end users
    • Optimized for read performance
    • Typically SSD-based for speed
    • Limited capacity focused on most popular content

  2. Regional/Parent Caches:

    • Serve multiple edge locations
    • Larger storage capacity
    • Reduce origin fetches across multiple edge servers
    • Often handle more specialized or less frequently accessed content

  3. Origin Shield:

    • Intermediate caching layer between edge network and origin
    • Consolidates cache misses from multiple edge servers
    • Protects origin from traffic spikes during mass cache invalidations
    • Often positioned in the region closest to the origin

  4. Negative Caching:

    • Caching 404s and other error responses
    • Prevents repeated requests for non-existent resources
    • Configurable TTLs specifically for error responses

Cache Key Generation

How CDNs determine what constitutes a unique cacheable object:

  1. Standard Cache Keys:

    • Hostname + URI path + query string
    • Protocol (HTTP vs HTTPS)
    • Accept and Accept-Encoding headers

  2. Custom Cache Keys:

    • Include/exclude specific query parameters
    • Consider specific headers (e.g., User-Agent, Cookie)
    • Vary header handling for content negotiation
    • Custom key normalization rules

  3. Cache Segmentation:

    • Device detection (mobile vs desktop)
    • Geographic segmentation (country-specific content)
    • Language-based segmentation
    • A/B testing segments

Content Optimization Techniques

CDNs perform various optimizations at the edge:

  1. Image Optimization:

    • Format conversion (WebP, AVIF for browsers that support them)
    • Automatic quality adjustment
    • Responsive image resizing
    • Progressive loading support

  2. Compression:

    • Gzip for text-based assets (HTML, CSS, JS)
    • Brotli for more efficient compression
    • Dynamic compression based on client capabilities
    • Compression level tuning for performance vs. size

  3. Minification:

    • On-the-fly code minification for HTML, CSS, JS
    • Whitespace removal
    • Comment stripping
    • Code optimization

  4. HTTP Protocol Optimization:

    • HTTP/2 multiplexing
    • HTTP/3 (QUIC) support for reduced latency
    • TLS session resumption
    • Connection keep-alive management

Edge Computing Capabilities

Modern CDNs extend beyond simple caching:

  1. Serverless Edge Functions:

    • JavaScript/WASM execution at the edge
    • Sub-millisecond cold start times
    • Request/response manipulation
    • Implementation examples:
      • Cloudflare Workers
      • AWS Lambda@Edge
      • Fastly Compute@Edge

  2. Edge Logic:

    • Conditional request routing
    • A/B testing
    • Personalization at the edge
    • Authentication and authorization

  3. Edge Data Solutions:

    • Distributed key-value stores
    • Edge databases with global replication
    • Rate limiting counters
    • Session state management

  4. Stream Processing:

    • Real-time video optimization
    • Adaptive bitrate streaming (HLS, DASH)
    • Live stream modification
    • Video DRM handling

Security Features

CDNs provide important security services:

  1. Web Application Firewall (WAF):

    • OWASP Top 10 protection
    • Custom rule sets
    • Rate-based rules
    • IP reputation filtering

  2. DDoS Mitigation:

    • Layer 3/4 attack protection (SYN floods, UDP floods)
    • Layer 7 attack protection (Slowloris, HTTP floods)
    • Traffic pattern analysis
    • Challenge-based verification (CAPTCHA, JavaScript challenges)

  3. Bot Management:

    • Bot classification (good/bad/unknown)
    • Machine learning-based detection
    • Device fingerprinting
    • Behavioral analysis

  4. TLS/SSL Management:

    • Certificate provisioning and renewal
    • Custom cipher suite configuration
    • TLS version control
    • Perfect Forward Secrecy

Origin Connectivity

How CDNs connect back to origin servers:

  1. Origin Pull Methods:

    • HTTP/HTTPS connections
    • Custom origin ports
    • Origin authentication methods
    • Connection pooling

  2. Origin Selection Logic:

    • Primary/backup origins
    • Origin health checks
    • Failover criteria and routing
    • Origin groups for different content types

  3. Origin Shielding:

    • Consolidating requests to origin
    • Regional request aggregation
    • Connection optimization
    • Keep-alive management

  4. Load Balancing:

    • Multiple origin distribution
    • Weighted routing
    • Least connections algorithm
    • Geographical origin routing

Analytics and Monitoring

CDNs provide extensive visibility into traffic:

  1. Real-time Metrics:

    • Request rates
    • Cache hit ratios
    • Bandwidth consumption
    • Error rates

  2. Log Delivery:

    • Real-time log streaming
    • BigQuery/S3/Azure integration
    • Custom log field selection
    • Sampling rates for high-volume sites

  3. Performance Analytics:

    • Time to first byte (TTFB) metrics
    • RUM (Real User Monitoring) integration
    • Core Web Vitals reporting
    • Geographic performance breakdowns

  4. Security Analytics:

    • Threat detection reporting
    • Attack patterns visualization
    • Bot traffic analysis
    • DDoS attempt monitoring