Content Delivery Networks: Caching, Origin Shielding and Security

A content delivery network puts copies of your content on servers close to your users, so a request travels tens of miles instead of thousands. That is the whole idea. Everything else — the security features, the routing tricks — follows from having a distributed layer in front of the origin.

Why Distance Matters More Than Bandwidth

Light in fibre covers roughly 200 kilometres per millisecond, and real paths are never direct. A round trip from Sydney to a server in Virginia costs around 200 milliseconds before the server does anything at all.

Worse, that cost is paid repeatedly. A TLS handshake takes multiple round trips, and TCP slow start means a connection does not reach full speed immediately. Adding bandwidth does not help; the delay is geometric, not volumetric. Moving the content closer is the only fix.

How a Request Finds the Nearest Edge

Two mechanisms, and exams ask about both.

DNS-based routing. The CDN's authoritative nameserver returns a different address depending on where the query appears to come from. Simple and widely used, though it judges by the resolver's location rather than the user's — which is why a user on a distant public resolver can be sent somewhere unhelpful. Understanding DNS record types, particularly CNAME, makes CDN configuration much clearer.

Anycast. The same IP address is advertised from many locations, and BGP delivers the packet to whichever is nearest in routing terms. Failover is automatic, since withdrawing a route removes a location from service.

Caching

The edge keeps a copy and serves it directly. Three terms carry the weight:

• TTL — how long the edge may serve a cached object before revalidating. Long TTLs mean better performance and staler content.
• Cache hit ratio — the proportion served without contacting the origin. This is the number that determines whether the CDN is earning its cost.
• Invalidation, or purge — explicitly telling the CDN to discard an object before its TTL expires, used when content changes unexpectedly.

Static assets cache trivially. Dynamic and personalized content does not, and the standard technique is to vary the cache key — including or deliberately excluding cookies, query strings and headers — so that personalized responses are not served to the wrong user. Getting that wrong is a real data-exposure bug, not merely a performance one.

Origin shielding adds an intermediate tier: edges fetch from a designated shield node rather than all hitting the origin directly, which protects the origin when many edges miss at once.

Security Functions

Because every request passes through it, a CDN is a natural enforcement point.

• DDoS absorption. A distributed network with enormous aggregate capacity absorbs volumetric floods that would overwhelm a single site — including the reflection and amplification attacks described in DRDoS.
• Web application firewall. Most CDNs offer an integrated WAF, inspecting requests before they ever reach the application.
• TLS termination at the edge, shortening the handshake for the user. Note what this means: the CDN decrypts your traffic. That is a real trust decision, not a footnote.
• Bot management and rate limiting applied before origin resources are consumed.
• Origin concealment. Users never learn the origin address — provided it is not leaked elsewhere, which it frequently is through mail headers, old DNS records or certificate transparency logs. An origin discoverable by internet-wide scanning can be attacked directly, bypassing every protection above.

What Can Go Wrong

Cache poisoning — an attacker gets a malicious response stored and served to everyone. Usually caused by unkeyed inputs: a header the origin reflects into the response but the CDN ignores when building the cache key.

Cache deception — tricking the CDN into caching a personalized page by requesting it with a path that looks static, then retrieving another user's data from the cache.

Stale content after a purge failure, which in the worst case keeps a vulnerable asset in circulation after it was supposedly replaced.

Exam Focus

Know a CDN reduces latency by reducing distance, and that this is about round trips, not bandwidth. Know anycast and DNS-based routing as the two steering methods. Know TTL governs freshness and purging forces an update. Know TLS termination at the edge means the provider sees plaintext. And recognize origin IP exposure as the flaw that defeats CDN-based DDoS protection entirely.