advanced

CDN and cache-control

Design public, private, and surrogate caching with TTLs, stale-while-revalidate, Vary, purge flows, shielding, and personalized response safety.

CDNs cache responses at edge PoPs close to users. Origin headers drive behavior: `Cache-Control`, `Surrogate-Control`, `CDN-Cache-Control`, `s-maxage`, `stale-while-revalidate`.

Public catalog JSON can be cached globally; personalized dashboards need `private, no-store` or edge logic that varies by cookie/header with correct `Vary`.

					Cache-Control: public, max-age=0, s-maxage=300, stale-while-revalidate=60
Surrogate-Key: product-123

Surrogate keys (or tag-based purge) let you invalidate related objects without URL-by-URL purge. Shield/origin layers reduce load on the primary origin.

On interviews: explain cache miss vs hit debugging; why query strings break cache keys unless normalized; PCI/PII must never sit on shared edge caches.

Common pitfalls: caching HTML shells with embedded user data; forgetting to purge after admin edits; geo variance without monitoring per-PoP errors.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

Classify routes as public edge, private browser, or no-store.
Use surrogate keys for bulk invalidation.
Test from multiple regions after deploy.
Monitor hit ratio and origin offload.