Your origin server is in Virginia. Your user is in Singapore. A round-trip over the Pacific is ~180ms, minimum, without TLS handshake, TCP slow-start, or any actual work. Serve a page with 40 assets (images, scripts, fonts) and you're looking at a 2–3 second page load before you've computed anything.
A CDN copies your static assets to ~300 data centers globally. The Singapore user hits a machine 20ms away. You didn't change your code — you pushed the bytes closer to eyeballs.
02
Intuition
A global chain like Starbucks doesn't have one central warehouse shipping coffee to every store daily. They have regional warehouses. Your local Starbucks restocks from the warehouse 50 miles away, not the roastery in Seattle.
The origin is the roastery (the source of truth, the place that makes the coffee). The edge is the local warehouse (cached copies, close to customers). When demand spikes, the warehouse absorbs it — the roastery never notices.
03
How it works
When a request hits the CDN edge (closest PoP to the user):
Cache hit? Return the cached bytes immediately. ~10–50ms. Done.
Cache miss? Edge fetches from origin (or from a regional "shield" cache upstream), stores the response, returns it. First user pays the latency cost; the next 10,000 don't.
Cache keyed by URL + chosen headers (e.g., Accept-Encoding so gzip vs brotli get separate entries). If you add Cookie to the cache key, you'll have zero hit rate — every user is different.
TTL from origin headers — Cache-Control: max-age=86400 means cache for a day. Or set it in the CDN config.
Two pull modes:
Pull CDN (default): edges fetch on first miss. Zero ops cost, first users are slow. What Cloudflare, Fastly, CloudFront do by default.
Push CDN: you upload assets to edges ahead of time (via API or S3 sync). Zero first-user latency, but you manage invalidation. Video platforms use this.
~300
PoPs (Cloudflare, 2025)
~10–50ms
edge hit latency
90–99%
typical hit rate
70–90%
origin traffic reduction
04
Variants
Pull CDN
Lazy, on-miss fetch
What you use for websites, APIs with cacheable responses, public static files. Configure Cache-Control headers at origin and forget. Invalidation via API call or versioned URLs (/app.abc123.js).
Push CDN
Proactive upload
What you use for video streaming, game client patches, scheduled content drops. You pay the upload cost once; first viewer gets edge speed. Common with S3 + CloudFront origin-failover.
05
Tradeoffs
When CDN absolutely wins: static assets, images, videos, public APIs with long TTLs, HTML for logged-out pages, software downloads. Anything cacheable gives you orders-of-magnitude latency + cost improvement.
When CDN doesn't help:
Personalised responses (logged-in HTML) — cache key must include user ID, hit rate ≈ 1 per user, cache is pointless.
Mutations (POST/PUT/DELETE) — CDNs pass these straight through to origin.
Dynamic data with sub-second freshness needs — short TTLs defeat the purpose.
Cookie trap
If your app sets a session cookie on every request (even public pages), and your CDN is configured to vary cache by Cookie, your hit rate drops to 0%. Either scope cookies to authenticated paths (Set-Cookie; Path=/app) or explicitly strip them at the edge.
06
Deep dive — invalidation & versioning
You deployed a new app.js. Users around the world still have app.js cached at the edge for the next 24 hours (per your TTL). Two ways to fix this:
Explicit purge — call the CDN API: POST /zones/xyz/purge_cache {"files": ["https://cdn.example.com/app.js"]}. Cloudflare: ~30 seconds globally. CloudFront: ~60 seconds. Fastly: ~150ms (industry-leading). Explicit purge is simple but every deploy costs an API call per changed file.
Versioned URLs (preferred) — include a content hash in the filename: /app.abc123.js. The URL changes when the content changes, so the CDN sees a new cacheable object. Old URLs stay in cache forever (harmless) or get evicted by LRU. Zero invalidation API calls. Your HTML references the new versioned URL, users fetch it on next page load.
Modern webpack/Vite/Next.js all emit versioned asset URLs by default. Ship versioning, skip purging.
07
Real-world
Cloudflare
Global pull CDN + security
~300 PoPs. DDoS protection, WAF, edge workers. Free tier handles startup traffic; paid tiers go to enterprise scale.
AWS CloudFront
Pull CDN, S3-native
~400 edge locations. Tight integration with S3, ALB, API Gateway. Slightly slower purge (~60s) but cheapest for AWS-native stacks.
Fastly
Programmable edge
VCL-based config, instant purge (~150ms). What the NYT, GitHub, and Stripe use. Expensive but unmatched control.
Akamai
The incumbent
Biggest network (~400k servers in ~130 countries), used by Apple, Netflix (partly), government sites. Complex to configure; enterprise-only pricing.
08
Used in problems
URL shortener puts redirects on the edge. YouTube/Netflix push encoded video to regional CDN caches. Google Drive caches thumbnails and file metadata. Live streaming pushes HLS segments to the edge.