A content delivery network (CDN) is a geographically distributed network of servers that caches and delivers web content from locations close to users, speeding up websites and absorbing attacks.
How a CDN works
Instead of every visitor connecting to the website’s origin server, DNS or anycast routing sends them to the nearest CDN edge server. The edge returns cached images, scripts and pages, and forwards only the remaining requests to the origin, acting as a large-scale reverse proxy server. Akamai, founded in 1998, pioneered the model; Cloudflare, Fastly, Amazon CloudFront and others now carry a large share of all web traffic.
Why CDNs matter for security
Modern CDNs are also security platforms. They terminate TLS, filter traffic with web application firewalls, manage bots and spread volumetric DDoS attacks across huge global capacity, so sites behind them survive floods that would overwhelm a single data centre. They also conceal the origin server’s real IP address.
Concentration brings its own risks:
- Single points of failure – in June 2021 a configuration bug at Fastly briefly took down many major news and government websites worldwide.
- Data leaks – the 2017 Cloudbleed bug caused Cloudflare edge servers to leak fragments of memory, including cookies and tokens, into web pages.
- Origin exposure – if attackers discover the origin’s IP address through old DNS records or email headers, they can bypass the CDN protection.
- Abuse – attackers host phishing pages and malware on trusted CDN domains, and “domain fronting” (MITRE ATT&CK T1090.004) hides command-and-control traffic behind them.
Best practices
- Allow origin connections only from the CDN’s address ranges or authenticated tunnels.
- Enable the WAF, rate limiting and DDoS protection features and review their rules.
- Use Subresource Integrity for third-party scripts loaded from public CDNs.
- Plan for CDN outages with failover options for critical services.
