Log in
SkillPilotAI
Plans

CDN: Content Delivery Network

A CDN keeps copies of images, videos and JS/CSS on edge servers around the world so the user gets content quickly from nearby.

2.1 Why is it used?

  • If a user in Chennai had to fetch every image from a US server, the page would open slowly. A CDN edge server sits close to the user's city.
  • Origin server load drops by 80-95% because most requests are served from the edge cache.
  • For spikes like a sale day or an IPL match, when lakhs of users need the same content, only a CDN can scale.
  • Bandwidth cost goes down and DDoS attacks get absorbed at the edge itself.
  • Optimizations like TLS termination, HTTP/2, HTTP/3 and image compression come free at the edge.

2.2 How it works

Hotstar IPL live: a chunk leaves the origin once, everyone else gets a HIT from the edge
  1. 1.The Live Encoder cuts the video into 2-10s chunks + a manifest and uploads them to the Origin (S3 / ALB)
  2. 2.A Chennai user asks for seg_101.ts -> MISS at the Chennai Edge PoP
  3. 3.The edge first asks the Origin Shield (middle / tiered cache); if it is not there either, only 1 request reaches the Origin
  4. 4.The chunk is kept in the edge cache until the TTL (Cache-Control: max-age=86400)
  5. 5.A second Chennai user asks for the same chunk -> Cache HIT ~10 ms
  6. 6.The Delhi Edge PoP does not have a copy yet -> MISS, and there too the copy is cached from the shield

One chunk is needed by crores of people but leaves the origin only once, so origin load drops by 80-95%

  • Edge / PoP (Point of Presence): the CDN's servers around the world; DNS or anycast sends the user to the nearest PoP.
  • Cache HIT vs MISS: if the content is at the edge it is a HIT (fast); if not it is a MISS, and the edge fetches it from the origin and caches it.
  • Cache-Control / TTL: the origin sends a header like 'Cache-Control: max-age=86400', and the edge keeps the copy for that long.
  • Cache invalidation / purge: after deploying a new version, purge the old object, or put a version/hash in the file name (app.v2.js).
  • Origin Shield / tiered cache: a middle cache layer between the edges so duplicate MISS requests do not reach the origin.
  • Push vs Pull CDN: in Pull the edge fetches from the origin itself (common); in Push you upload the content in advance.
  • Dynamic content acceleration: even for non-cacheable API calls the CDN gives an optimized network route and persistent connections.
  • Video streaming: HLS/DASH chunks (2-10 second files) are served from the CDN, which is how lakhs of viewers get handled.
What to cache, what not to cache + multi-CDN
  1. 1.Cache (public): images, JS/CSS, video chunks; names with a hash like app.v2.js, long max-age
  2. 2.Do not cache (private): cart, profile, OTP; set 'Cache-Control: private, no-store' or someone else's data will be shown
  3. 3.After a deploy: purge the old object (Fastly purges in ms) or use a new file name
  4. 4.Multi-CDN (Akamai + CloudFront + Cloudflare / Azure Front Door): if one CDN has an issue, traffic shifts to another CDN
  5. 5.Allow the origin only from CDN IPs to prevent a bypass attack; bonus at the edge: TLS termination, HTTP/2-3, compression, DDoS absorption

2.3 Which tools can be used

ToolTypeHow it is used
AWS CloudFrontManaged CDN (AWS)Sits in front of S3, an ALB or any origin. You can run code at the edge with Lambda@Edge / CloudFront Functions.
AkamaiEnterprise CDNThe oldest and biggest CDN, with a very large number of PoPs. Used for big media, banking and OTT live streaming.
Cloudflare CDNAnycast CDN + securityThe CDN becomes active as soon as you turn on the DNS proxy. Free plan, WAF, DDoS and Workers (edge compute) together.
Azure Front DoorGlobal CDN + L7 load balancer (Azure)Gives global HTTP load balancing, WAF and path-based routing along with CDN caching.
Google Cloud CDNManaged CDN (GCP)Enabled together with the GCP global HTTP(S) load balancer.
FastlyProgrammable CDNVery fast purge (in milliseconds) and VCL/Compute edge logic, popular on news and e-commerce sites.

2.4 Comparison: CloudFront vs Akamai vs Cloudflare vs Azure Front Door

PointCloudFrontAkamaiCloudflareAzure Front Door
Network sizeLarge, 600+ PoPsThe largest distributed networkLarge anycast network, 300+ citiesMicrosoft global edge network
SetupAWS console, origin = S3/ALBComplex, done with an account teamEasiest: just a DNS changeAzure portal, easy with Azure origins
Security bundleAdd AWS WAF + Shield separatelyKona / App & API Protector (paid)WAF, DDoS, bot built in (in plans)WAF built in (Premium tier)
Edge computeLambda@Edge, CloudFront FunctionsEdgeWorkersWorkers (very popular)Rules engine, limited compute
CostPay per GB + requestsEnterprise contract, expensiveStarts with a free plan, flat pricingPay per GB + base fee
Best forAWS-hosted appsBig OTT, banks, enterprisesStartup to enterprise, when you also need securityAzure-hosted apps, global L7 routing

2.5 When to choose which

  • CloudFront: when the origin is S3 or an AWS ALB. Data transfer from AWS to CloudFront is free.
  • Akamai: for very large live events / OTT where you need reach inside every ISP and enterprise support.
  • Cloudflare: when you want quick setup, low cost, and CDN + WAF + DDoS in one place.
  • Azure Front Door: for Azure apps that need global load balancing along with the CDN.
  • Big players use multi-CDN (2-3 CDNs): if one CDN has an issue, traffic shifts to another.

2.6 Real-world example

Real world: IPL live streaming on Hotstar (JioHotstar)

  1. During the IPL final crores of concurrent viewers arrive (Hotstar publicly reported a record of about 2.5 crore concurrent in 2019).
  2. The live video encoder cuts the video into small chunks (HLS/DASH segments of a few seconds) and places them on the origin.
  3. Edge servers of multiple CDN partners cache these chunks, often even inside the ISP's data center.
  4. The user's app fetches the manifest file, then every few seconds downloads the new chunk from the nearest edge.
  5. One chunk is needed by crores of people, but it comes from the origin only once per edge/shield. Everyone else gets a cache HIT.
  6. If the network is slow, the player asks for a lower-bitrate (480p) chunk. This is called adaptive bitrate streaming.
  7. Result: the load on the origin stays small, and 'Dhoni's six' reaches everyone with a delay of a few seconds.

2.7 Interview tips

  • In the interview be sure to mention cache hit ratio, TTL, invalidation and 'origin shield'.
  • Mistake: caching user-specific data (cart, profile) by accident. One user's data can show up for another. Set 'Cache-Control: private, no-store' on private data.
  • Mistake: forgetting to purge after a deploy. Users keep seeing old JS/CSS. Putting a hash in the file name is the best practice.
  • Mistake: leaving the origin public. An attacker will bypass the CDN and hit the origin directly. Allow the origin only from CDN IPs/headers.
  • Number: a CDN cuts origin load by 80-95%; a cache HIT takes ~10 ms.