CDN (Content Delivery Network)

Why This Comes Up in Interviews

Any system design that serves static content, images, video, or has global users will require CDN discussion. Interviewers want to hear:

• How you reduce latency for global users
• How you protect your origin from traffic spikes
• Your cache invalidation strategy (one of the "two hard problems in CS")
• Trade-offs between consistency and performance

How CDN Works — The Mental Model

Without CDN: User in Tokyo → request travels 12,000km to Virginia origin → 200ms latency (speed of light in fiber ≈ 200km/ms round trip)

With CDN: User in Tokyo → request goes to Tokyo edge (5km away) → 5ms latency (cache hit) OR edge fetches from origin, caches, then serves → subsequent requests instant

The physics: Light in fiber travels at ~⅔ speed of light = ~200,000 km/s. Round trip Tokyo→Virginia = ~24,000km / 200,000 = ~120ms minimum. No amount of engineering beats physics. CDN puts content close to users.

Back-of-Envelope: CDN Economics

Scenario: Serving 1 billion images/day, average 200KB each.

Key insight: CDN is CHEAPER than scaling your own origin globally, even with CDN fees.

Push vs Pull: Two CDN Models

90% of the time, pull is correct. Push is for Netflix pre-positioning a new series on release day, or game patches ready at launch.

Cache Invalidation Strategies (The Hard Part)

The winning answer for interviews:

"For static assets (JS, CSS, images), I'd use content-hashed URLs with infinite TTL — bundle.a1b2c3.js. The URL IS the version, so there's zero invalidation complexity. For dynamic content like article pages, I'd use short TTL (60s) with stale-while-revalidate, plus a purge API for immediate corrections."

Why versioned URLs are superior:

• Immutable: same URL always returns same content
• Infinite TTL: never expires, never stale
• Instant deployment: new build = new URL = new content
• Atomic: users get all-old or all-new, never mixed
• Zero purge calls: no coordination needed

CDN Architecture in Depth

Multi-tier caching (how Cloudflare/Akamai work):

User → Edge (Tokyo PoP)
         ↓ cache miss
       Shield (Singapore regional)
         ↓ cache miss
       Origin (Virginia)

Shield layer means: if 50 edge PoPs all get cache miss simultaneously, only ONE request goes to origin (shield coalesces them). Without shield: 50 origin hits.

What Gets Cached — Decision Framework

Cache key composition:

Default: URL path + query string. But sometimes you need:

• Vary: Accept-Encoding — different response for gzip vs brotli
• Vary: Accept-Language — different language versions
• Custom cache keys — strip tracking parameters (utm_source) from cache key

Edge Compute — CDN as Application Platform

Modern CDNs aren't just caches — they run code at the edge:

Interview-relevant patterns:

• Edge-side auth: Validate JWT at edge, reject invalid before reaching origin
• Edge-side A/B: Route 10% of traffic to variant at edge (no origin change)
• Edge-side personalization: Inject user name into cached HTML template
• Edge-side rate limiting: Block abusive IPs before they consume origin resources

CDN + Security

Real-World CDN Decisions

Multi-CDN Strategy

Large companies use multiple CDNs:

Implementation: DNS-level routing (Route53/NS1) directs traffic based on latency, health checks, or geography.

Interview Framework

When designing any system with global users or static content:

Step 1: "For static assets (images, JS, CSS), I'd serve through a CDN with content-hashed URLs and infinite TTL. This gives us global low-latency access with zero cache invalidation complexity."

Step 2: "For dynamic but cacheable content, I'd use short TTL (30-60s) with stale-while-revalidate. Most users get cached response; background refresh keeps it fresh."

Step 3: "CDN also gives us DDoS protection and origin offload. At [X] requests/sec, origin only sees 5% (cache miss traffic)."

Step 4: "For the write path and authenticated content, requests go directly to origin — CDN only helps the read path."

Back-of-envelope: "[Y] daily requests × [Z]KB average × (1 - hit rate) = origin bandwidth needed."

Quick Recall