What belongs on a CDN?
“What should you put on a CDN, what should you not, and how do you invalidate it? Include the numbers that justify a CDN in the first place.”
What this tests
- The physics: latency to a far origin vs a nearby edge
- Cacheability by content type: static assets, public pages, personalised content, APIs
- Versioned URLs vs purge; cache keys
- Origin protection: shielding, request collapsing
Answers by level
Read the beginner answer first and notice what is missing.
The justification is distance and origin load. A round trip from Sydney to a Frankfurt origin is around 250–300 ms before any work happens; an edge in Sydney answers in under 20 ms. A page that loads 40 assets pays that gap many times over. The second win is that the origin stops serving bytes it does not need to compute: a 2 MB bundle downloaded a million times a day is 2 TB of egress the origin never sees.
What to cache: immutable static assets with a content hash in the filename and a one-year max-age — invalidation is unnecessary because a change is a new URL. Public, identical-for-everyone pages and API responses with a short TTL and stale-while-revalidate. Large media. What not to cache: anything personalised or authenticated unless the cache key includes the variation and the TTL is deliberate; responses with Set-Cookie; anything where a stale read is a correctness problem (account balance).
Invalidation: prefer versioned URLs for assets; use short TTLs for pages; purge is for mistakes and emergencies, and purge propagation is not instant. The cache key must include everything that varies the response — locale, device class, query parameters that matter — and exclude what does not, or the hit ratio collapses.
Green flags · Red flags
- Quotes latency numbers and egress savings as justification
- Uses content-hashed URLs with long max-age for assets
- Caches public pages with short TTL and stale-while-revalidate
- Excludes personalised or Set-Cookie responses unless keyed deliberately
- Knows origin shielding and request collapsing
- "Put everything behind the CDN; it makes everything faster."
- Relies on purge as the primary invalidation mechanism
- Caches authenticated responses without varying the key
- Cannot say why the origin gets hammered when a popular object expires