Part 7: CDN (Content Delivery Network): Edge Caching, Anycast DNS & Origin Shielding
Lesson Overview & Learning Objectives
Even with optimized application code and database queries, your web application cannot evade the physical laws of nature: the speed of light in fiber optics introduces inescapable latency when users are separated by oceans. A user in Sydney requesting assets from an origin server in Frankfurt experiences ~300ms of pure round-trip network delay. Content Delivery Networks (CDNs) eliminate this penalty by distributing hundreds of caching proxy servers (Points of Presence) around the planet. In this article, we examine Anycast routing, cache hit/miss flows, origin shielding, and HTTP cache headers.
1. How Anycast BGP Routes Users to the Closest PoP
How does a single domain or IP address direct visitors in London to a London datacenter and visitors in Tokyo to a Tokyo datacenter? Through BGP Anycast:
Under traditional Unicast routing, each IP address belongs to exactly one physical server on the internet. With Anycast, hundreds of edge servers located across the globe advertise the exact same IP prefix via BGP. Core internet routers deliver the user's packet to the topologically closest edge server based on standard shortest AS-Path BGP metrics.
2. Cache Hit vs. Cache Miss & Origin Shielding
⚡ Cache Hit (90% - 98% of Requests)
The requested asset (e.g. app.js, hero.webp) is stored in the local edge PoP's NVMe SSD or memory tier and is still valid within its TTL. The edge immediately returns the response to the user within 5-15 milliseconds, with zero traffic reaching your origin server.
⚠ Cache Miss & Origin Shield
If the asset is missing or expired, the edge proxy must fetch it. Without protection, hundreds of edge PoPs experiencing simultaneous cache misses could trigger a Thundering Herd problem, overloading the origin server. A modern CDN uses an Origin Shield—a centralized caching tier placed in front of your origin datacenter—to consolidate edge misses into a single origin request.
3. Mastering Modern HTTP Caching Headers
| Header Directive | Cached By | Engineering Behavior |
|---|---|---|
| public, max-age=31536000, immutable | Browser & CDN | Used for content-hashed assets (e.g., bundle.a8f9c1.js). Never revalidates for 1 year. |
| s-maxage=86400, max-age=0 | CDN Only | Instructs public CDN caches to store for 24 hours while forcing end-user browsers to always revalidate. |
| stale-while-revalidate=60 | Browser & CDN | Instantly serves stale cached content to user while asynchronously fetching fresh content in background. |
| ETag: "686897696a7c" / If-None-Match | Validation | Conditional revalidation: if asset has not changed, origin returns 304 Not Modified with empty body. |
Related reading
Part 10: Cloud to Fog & Edge: Architecting the Distributed Continuum
Explore the distributed computing continuum: compare centralized cloud, fog computing gateways, and real-time edge nodes for latency-critical IoT systems.
By Md. Harun-Or-Roshid
Part 9: Load Balancing: Layer 4 vs Layer 7, Algorithms, Reverse Proxies & High Availability
Master high-availability load balancing, comparing Layer 4 transport vs Layer 7 application routing, consistent hashing rings, and health checks.
By Md. Harun-Or-Roshid
Part 10: Network Layer Addressing: IPv4 Subnetting, CIDR & IPv6 Architecture
Master logical network addressing: explore IPv4 classful ranges, CIDR slash notation, subnet mask bitwise ANDing, and modern 128-bit IPv6 architecture.
By Md. Harun-Or-Roshid
Part 8: VPN Explained: Cryptographic Tunnels, WireGuard, IPSec & Network Privacy
A deep dive into Virtual Private Networks, examining cryptographic packet encapsulation, virtual TUN/TAP adapters, WireGuard, and IPSec.
By Md. Harun-Or-Roshid