WEB / WEB-09.04

CDN, edge, and origin relationships

Receiving a body from the edge does not mean the origin executed. Separate two-hop ownership using public MISS/HIT and personal bypass.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Public MISS

Prepare request
Duru prepares GET for the selected harmless representation; neither edge nor origin has received this request.
Browser / Duru
GET /catalog ready
Edge / public cache
Cache: empty
Origin / Atlas
Request absent
Edge received request
The edge receives the request; body selection and shared storage have not been decided.
Browser / Duru
Waiting edge
Edge / public cache
GET /catalog received; cache empty
Origin / Atlas
Request absent
Outbound request ready
Local edge policy selects MISS and prepares an outbound GET; lookup is not a network message.
Browser / Duru
Waiting edge
Edge / public cache
MISS; outbound GET ready
Origin / Atlas
Request absent
Origin received request
The origin receives the edge request while the Browser still awaits the edge response.
Browser / Duru
Waiting edge
Edge / public cache
MISS; waiting origin
Origin / Atlas
GET /catalog received
Origin response ready
The origin locally prepares the selected harmless body and cache metadata; the edge has not learned the body.
Browser / Duru
Waiting edge
Edge / public cache
MISS; waiting origin
Origin / Atlas
200 ready; Atlas catalog; public, max-age=60
Origin response arrived
The origin 200 body and metadata reach the edge without changing the Browser’s observed state.
Browser / Duru
Waiting edge
Edge / public cache
200 received; Atlas catalog; storage pending
Origin / Atlas
200 ready; Atlas catalog; public, max-age=60
Delivery decision ready
The edge stores the body under selected public eligibility and prepares a Browser response, not yet received.
Browser / Duru
Waiting edge
Edge / public cache
200 ready; Atlas catalog; public v1 stored
Origin / Atlas
200 ready; Atlas catalog; public, max-age=60
Browser received response
Duru learns the body on the final hop; this arrival and origin-to-edge arrival belong to separate exchanges.
Browser / Duru
200 received; Atlas catalog
Edge / public cache
200 ready; Atlas catalog; public v1 stored
Origin / Atlas
200 ready; Atlas catalog; public, max-age=60

Public HIT

Public GET ready
Duru prepares the public catalog GET; the supplied edge entry is v1 with current age5.
Browser / Duru
GET /catalog ready
Edge / public cache
Public v1; age5; lifetime60
Origin / Atlas
Not contacted
Edge received request
The edge receives the public GET; reusable-entry selection remains a separate local decision.
Browser / Duru
Waiting edge
Edge / public cache
GET received; public v1; age5
Origin / Atlas
Not contacted
HIT response ready
Selected key match and5<60 produce a public HIT; no origin request is prepared and the body comes from the local entry.
Browser / Duru
Waiting edge
Edge / public cache
HIT; 200 ready; Atlas catalog; Age5
Origin / Atlas
Not contacted
Cached body arrived
Duru receives the public body from the edge; this branch shows no new origin execution.
Browser / Duru
200 received; Atlas catalog; Age5
Edge / public cache
HIT; 200 ready; Atlas catalog; Age5
Origin / Atlas
Not contacted
Read the ownership distinction
The Browser observation is complete; the origin remaining not contacted expresses the shorter delivery path.
Browser / Duru
Public body observed
Edge / public cache
Public v1 retained
Origin / Atlas
Not contacted

Personal bypass

Prepare request
Duru prepares GET for the selected harmless representation; neither edge nor origin has received this request.
Browser / Duru
GET /notes/mine ready
Edge / public cache
Cache: public v1 retained
Origin / Atlas
Request absent
Edge received request
The edge receives the request; body selection and shared storage have not been decided.
Browser / Duru
Waiting edge
Edge / public cache
GET /notes/mine received; cache public v1 retained
Origin / Atlas
Request absent
Outbound request ready
Local edge policy selects bypass and prepares an outbound GET; lookup is not a network message.
Browser / Duru
Waiting edge
Edge / public cache
bypass; outbound GET ready
Origin / Atlas
Request absent
Origin received request
The origin receives the edge request while the Browser still awaits the edge response.
Browser / Duru
Waiting edge
Edge / public cache
bypass; waiting origin
Origin / Atlas
GET /notes/mine received
Origin response ready
The origin locally prepares the selected harmless body and cache metadata; the edge has not learned the body.
Browser / Duru
Waiting edge
Edge / public cache
bypass; waiting origin
Origin / Atlas
200 ready; Duru reading note; no-store
Origin response arrived
The origin 200 body and metadata reach the edge without changing the Browser’s observed state.
Browser / Duru
Waiting edge
Edge / public cache
200 received; Duru reading note; storage pending
Origin / Atlas
200 ready; Duru reading note; no-store
Delivery decision ready
The edge does not store the no-store personal body; its public entry remains and the Browser response is ready.
Browser / Duru
Waiting edge
Edge / public cache
200 ready; Duru reading note; not stored; public v1 retained
Origin / Atlas
200 ready; Duru reading note; no-store
Browser received response
Duru learns the body on the final hop; this arrival and origin-to-edge arrival belong to separate exchanges.
Browser / Duru
200 received; Duru reading note
Edge / public cache
200 ready; Duru reading note; not stored
Origin / Atlas
200 ready; Duru reading note; no-store

ACTORS · STATE · DATA FLOW

Which server does Duru connect to?

Let the public Atlas catalog URL use books.example. In the selected architecture, Duru connects to a CDN edge as the server peer rather than to the Atlas application process. Delivery introduces another owner without changing the URL’s public authority. A CDN distributes content from multiple locations; the single edge in this diagram does not depict that entire network.

“Nearby” does not guarantee the shortest physical distance or the fastest node on every request. Finding the selected edge belongs to the earlier DNS and routing lessons. This lesson starts after selection; it produces no Anycast execution, capacity measurement, or global hit ratio. A topology diagram is not measured latency evidence.

Separate the origin role from a machine name

The Atlas origin produces the canonical public catalog representation in this example. Being the source of a response and being every Browser request’s direct socket peer are different roles. An origin might be one process, applications behind a load balancer, or another owned service; this fixture uses one logical origin supplying revision v1.

The edge acts as an HTTP client toward the origin and as an HTTP server toward Duru. The two hops have separate connection, error, and response-arrival boundaries. Receiving a body from the edge does not establish that the Browser connected to the origin or that the origin executed for that request.

MISS: two exchanges and three owners

The first branch starts with an empty edge cache. Duru prepares GET /catalog; after receipt, the edge finds no matching response. It prepares its own outbound GET and sends it to the origin. The origin prepares the public Atlas catalog body and cache metadata. Preparation is local; only arrival at another actor is drawn as a wire.

When the origin response reaches the edge, Duru still has not learned the result. Under this fixture’s eligibility rules, the edge stores the public representation and prepares a response for Duru. Final edge-to-Browser arrival closes that knowledge boundary. Carrying the same body on both hops does not make them one end-to-end socket exchange.

HIT: an idle origin matters

The second branch begins with a reusable public v1 entry for the selected key. The edge prepares a response from that local entry and sends no new request to the origin. An origin card remaining “not contacted” is meaningful: it shows where the data flow ends early. The public body received by the Browser is not the result of a new origin execution in this branch.

The fixture supplies current_age=5 and freshness_lifetime=60, selecting freshness through 5<60. Age is not an origin timestamp or a certificate of business correctness. Entry selection, storage eligibility, and freshness remain separate decisions. The earlier cache lesson covers the general current_age calculation.

Keep personal responses out of public entries

The third branch selects Duru’s harmless /notes/mine representation. This fixture classifies that route as shared-cache bypass before lookup, and the origin response carries no-store. The edge relays the response without writing a public cache entry. The Duru/Atlas context is supplied as allowed; this is not a real login or permission-enforcement test.

This conservative design does not claim that HTTP forbids caching every authenticated response. Requests carrying Authorization, cookie-based sessions, and application-specific identity are different mechanisms. Atlas only needs public catalog reuse here, so its personal route never enters shared storage.

Each TLS hop has its own trust boundary

For a TLS-terminating edge, Browser-to-edge and edge-to-origin are separate trust boundaries. Securing the first hop alone does not establish encryption or peer verification on the second. Cloudflare Full (strict) documentation is a vendor example of separately applied origin certificate verification; this lesson changes no Cloudflare settings.

This model shows HTTP message arrivals, without executing certificates, TLS records, or real CDN routing. The native check only observes public MISS/HIT and personal bypass between two owned loopback HTTP servers. That boundary separates understanding the CDN concept from validating an actual provider deployment.

Read every scenario without motion

Public HIT

Stored public content retained its metadata
GET /catalog has body Atlas catalog, allowedAudience public and Cache-Control public, max-age=60. selectedKey is GET /catalog. This key belongs only to the selected public route, not a general HTTP-cache-key parser.
Route/delivery ledger
Public catalog / key GET /catalog
Audience/reuse gate
Policy pending
Recipient boundary
No verdict
The fresh public copy became eligible for HIT
The HIT has currentAge 5 and freshnessLifetime 60. Storage and reuse predicates hold under this public contract. Equal-looking bodies alone do not prove a HIT; originContacted must also be reviewed.
Route/delivery ledger
Public catalog / key GET /catalog
Audience/reuse gate
Age5 < lifetime60 / public reuse eligible
Recipient boundary
No verdict
A successful reader response was not origin health
originContacted is false. Delivering a stored catalog does not establish current origin reachability or health. Edge and origin are separate owners; an ordinary HIT may explain absence of an origin-log event.
Route/delivery ledger
Public catalog / key GET /catalog
Audience/reuse gate
Age5 < lifetime60 / public reuse eligible
Recipient boundary
Public HIT / current origin health unknown
The personal target retained a different route class
GET /notes/mine has body Duru reading note with no-store. Its route class is bypass-before-lookup. The public catalog key is not used for the personal response; URL appearance does not replace classification.
Route/delivery ledger
Personal /notes/mine / bypass-before-lookup
Audience/reuse gate
Age5 < lifetime60 / public reuse eligible
Recipient boundary
Public HIT / current origin health unknown
Personal policy applied before shared lookup
The personal branch follows origin policy before selecting shared content; cacheKeysAfter contains only GET /catalog. Authorization allowed is supplied, not calculated. Cache bypass does not replace user/object permission.
Route/delivery ledger
Personal /notes/mine / bypass-before-lookup
Audience/reuse gate
Personal bypass / cache keys unchanged
Recipient boundary
Public HIT / current origin health unknown
The delivery contract was not a tenant-isolation claim
This public-reuse and personal-bypass contract is a teaching example. A real CDN, TLS, authenticated users and isolation across every route are unmeasured. Classification and business authority retain separate gates.
Route/delivery ledger
Personal /notes/mine / bypass-before-lookup
Audience/reuse gate
Personal bypass / cache keys unchanged
Recipient boundary
Route delivery scoped / user policy separate

Hop evidence

A MISS was selected with its origin-exchange requirement
The first catalog MISS in the independent sequence increases originCalls from 0 to 1. A cache key is added after the origin response. These local-ledger counts are neither benchmarks nor vendor access-log fields.
Route/delivery ledger
MISS: origin calls0→1 / catalog key added
Audience/reuse gate
Policy pending
Recipient boundary
No verdict
Stored state did not precede origin receipt
The edge can store a reusable copy only after receiving the response and deciding to store it. Cache lookup is local; origin transfer is another exchange. This review examines the ordering rule without a new network measurement.
Route/delivery ledger
MISS: origin calls0→1 / catalog key added
Audience/reuse gate
Receive response before storage decision
Recipient boundary
No verdict
First-hop results were not generalized to the deployment
Public-response success does not establish DNS, TLS peers or overall CDN availability. A failed MISS does not imply outage across the edge network. Record the smallest observed hop and owner decision separately.
Route/delivery ledger
MISS: origin calls0→1 / catalog key added
Audience/reuse gate
Receive response before storage decision
Recipient boundary
Selected hop known / deployment availability unknown
HIT and BYPASS count changes were separated
The second catalog HIT leaves originCalls at 1. Personal BYPASS increases it from 1 to 2 while retaining the catalog key. Equal final statuses do not establish identical intermediate owners.
Route/delivery ledger
HIT 1→1 / BYPASS 1→2
Audience/reuse gate
Receive response before storage decision
Recipient boundary
Selected hop known / deployment availability unknown
Connection security needed separate evidence per hop
A TLS-terminating deployment needs separate browser-edge and edge-origin peer verification. The loopback-HTTP native scope here is not a certificate test. Origin access restriction and failover are absent from this ledger.
Route/delivery ledger
HIT 1→1 / BYPASS 1→2
Audience/reuse gate
Per-hop TLS verification not measured
Recipient boundary
Selected hop known / deployment availability unknown
The control target stayed within the route contract
Controls target public classification, origin-call relationships and personal cache bypass. Purging, failover and real-provider behavior require their own configuration and runtime evidence. This bounded ledger does not claim those checks.
Route/delivery ledger
HIT 1→1 / BYPASS 1→2
Audience/reuse gate
Per-hop TLS verification not measured
Recipient boundary
Check classification/calls/bypass; provider scope separate

ASSUMPTION · BOUNDARY · CONTROL

Ask which owner supplied a body

During review, do not equate the response Duru observes with an origin access-log event. A public HIT can produce no origin request at all. Edge requests, origin requests, and Browser observations need distinct correlation boundaries. The ledger’s originContacted boolean belongs to this selected fixture; it is not a real log field or vendor header name.

A correct cached public catalog does not establish suitable delivery for a personal endpoint. A HIT on one route says nothing about safe reuse on every route. Review the representation’s audience, route class, and reuse conditions together. Matching extensions or status codes do not make a stylesheet and a user’s note share the same policy.

First-hop success does not validate the entire chain

If the edge already holds the public body, a successful Browser response does not establish current origin health or reachability. A failed MISS does not measure an outage of the entire CDN network either. Keep the review question precise: which hop ran for this request, which owner decided, and what state was observed?

Introducing an edge does not remove origin-side authorization or safe-output requirements. Evaluate public-cache classification separately from authenticated business decisions. This workbook uses a fixed reading note in place of personal data; its results describe no access to another user, bypass, or real network discovery.

Read every scenario without motion

Call sequence

The independent sequence retained before/after counts
The example edge adapter produces cache decisions/key membership; the origin server produces its call counter. independentSequence correlates both records before and after each request: MISS 0→1, HIT 1→1 and BYPASS 1→2. A HIT creates no origin-request event; a missing log in another trace does not prove the same decision. MISS, HIT and BYPASS are separate request observations. Origin counts are 0→1, 1→1 and 1→2 respectively. Review examines origin-contact scope per request rather than inferring it from response bodies.
Delivery observations
MISS +1 / HIT +0 / BYPASS +1
Call/cache comparison
Policy pending
Evidence conclusion
No verdict
HIT correlation was tied to the current request
The HIT selects stored Atlas catalog with originContacted false. The earlier MISS’s origin event is not a new event for the HIT request. Counts can be misread unless correlation retains request boundaries.
Delivery observations
MISS +1 / HIT +0 / BYPASS +1
Call/cache comparison
HIT request has no new origin call
Evidence conclusion
No verdict
Cache-key retention was separated from personal content
Duru reading note contains 17 UTF-8 bytes while the catalog contains 13. After BYPASS, keys remain only GET /catalog. Body count and storage membership are different evidence fields.
Delivery observations
Catalog13 / personal17 / only catalog stored
Call/cache comparison
HIT request has no new origin call
Evidence conclusion
No verdict
The ordinary negative control retained cache membership
Public MISS adds a key while personal BYPASS does not. This ordinary comparison demonstrates the shared-store boundary. As no authenticated user is computed, successful bypass is not a real tenant-enforcement result.
Delivery observations
Catalog13 / personal17 / only catalog stored
Call/cache comparison
Public stored / personal not stored
Evidence conclusion
No verdict
Native scope remained local policy behavior
The lesson’s native fixture can measure selected reuse/bypass between two owned plaintext loopback servers. The authored scene is not a newly executed test. CDN routing, DNS, TLS and purge/failover need separate evidence.
Delivery observations
Catalog13 / personal17 / only catalog stored
Call/cache comparison
Public stored / personal not stored
Evidence conclusion
Selected local policy / CDN runtime unmeasured
Regression checked source and body association together
Regression rechecks decision reason, origin-call delta, route class and cache membership together. Equal bodies alone are not a HIT criterion. Bounded metadata can support correlation without logging sensitive note content.
Delivery observations
Catalog13 / personal17 / only catalog stored
Call/cache comparison
Public stored / personal not stored
Evidence conclusion
Recheck decision/call delta/route/cache membership

Origin gap

Two ordinary explanations were separated for an absent event
The example edge adapter produces cache decisions/key membership; the origin server produces its call counter. independentSequence correlates both records before and after each request: MISS 0→1, HIT 1→1 and BYPASS 1→2. A HIT creates no origin-request event; a missing log in another trace does not prove the same decision. An origin log may lack a request because an ordinary HIT never contacted the origin or because log coverage is incomplete. The artifact supplies a HIT decision, but that value cannot be transferred automatically to a new trace.
Delivery observations
No origin event: possible HIT or coverage gap
Call/cache comparison
Policy pending
Evidence conclusion
No verdict
The edge decision record was checked separately
Observed HIT with originContacted false can explain absence under the selected contract. Without a decision record, seeing Atlas catalog does not prove the origin was skipped. Observer scope also matters.
Delivery observations
No origin event: possible HIT or coverage gap
Call/cache comparison
HIT evidence needed independently of body
Evidence conclusion
No verdict
The alternative review retained the missing decision
Here the edge decision and origin-observer coverage are unknown. The normal sequence’s 1→1 count is not copied into the incomplete trace. Absence does not establish no request, a healthy origin or an outage.
Delivery observations
Edge decision and origin coverage unknown
Call/cache comparison
HIT evidence needed independently of body
Evidence conclusion
No verdict
Correlation remained separate across owners
Edge requests, origin requests and browser observations are not one event. A HIT may have no origin request. Review identifies parent/request relationships and observation points instead of reducing the entire timeline to one success field.
Delivery observations
Edge decision and origin coverage unknown
Call/cache comparison
Separate edge/origin/browser observation scopes
Evidence conclusion
No verdict
The origin-contact verdict remained unknown
Origin contact remains UNKNOWN for this incomplete trace. An ordinary HIT being a possible explanation does not make every missing log a HIT. Negative events and unreliable observations are separate uncertainty sources.
Delivery observations
Edge decision and origin coverage unknown
Call/cache comparison
Separate edge/origin/browser observation scopes
Evidence conclusion
UNKNOWN: origin contact for this request
Targeted new evidence retained minimal scope
Further review needs request-scoped edge decisions, origin-call association and bounded coverage without full bodies, credentials or an entire network inventory. Health verdicts remain withheld until new evidence exists.
Delivery observations
Edge decision and origin coverage unknown
Call/cache comparison
Separate edge/origin/browser observation scopes
Evidence conclusion
Needed: decision/request association/coverage

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Write an explicit public-delivery contract

The example edge adapter produces cache decisions/key membership; the origin server produces its call counter. independentSequence correlates both records before and after each request: MISS 0→1, HIT 1→1 and BYPASS 1→2. A HIT creates no origin-request event; a missing log in another trace does not prove the same decision. For Atlas, define two route classes: reusable public catalog and personal note with bypass and no-store. This is an example policy, not automatic extension guessing. Body and cache metadata derive from the same classification. A changed public freshness lifetime or key should change the corresponding fixture expectation.

Do not mark an origin response as stored before it reaches the edge. After the edge makes its storage decision, it prepares the Browser response; Browser knowledge advances only on arrival. Reduced motion must preserve the same completed states. This separates network transfer from local operations such as cache lookup.

Check behavior at ownership boundaries

An independent observation expects one origin request for the first catalog MISS, no additional origin request for the second catalog HIT, and one additional origin request for a personal GET. The personal response must not change cache state. Body equality alone does not prove a HIT; combine it with the origin-call count and decision record.

In a real TLS-terminating deployment review, establish peer verification separately for both hops; do not present native loopback HTTP results as a certificate test. Origin access restrictions, cache purges, and failover depend on their own configuration. This small check validates public reuse and bypass without measuring those operations.

NOW APPLY IT TO THE CASE

How do HIT, MISS and personal BYPASS differ in ownership and evidence?

Public /catalog is fetched from the origin first and then served as a fresh HIT using the edge’s Atlas catalog. Personal /notes/mine bypasses shared lookup and carries no-store. Absence of an origin-log event alone determines neither request occurrence nor health.

Which cache owner supplies the case representation? Evaluate key scope, freshness and viewer context together; a hit does not establish the correct viewer.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Edge-delivery decisions and origin-call ledger

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "public": {
    "method": "GET",
    "target": "/catalog",
    "body": "Atlas catalog",
    "bodyOctets": 13,
    "originCacheControl": "public, max-age=60",
    "selectedKey": "GET /catalog",
    "allowedAudience": "public"
  },
  "personal": {
    "method": "GET",
    "target": "/notes/mine",
    "body": "Duru reading note",
    "bodyOctets": 17,
    "cacheControl": "no-store",
    "routeClass": "bypass-before-lookup",
    "authorization": "supplied allowed; not computed"
  },
  "hit": {
    "currentAge": 5,
    "freshnessLifetime": 60,
    "originContacted": false,
    "storedBody": "Atlas catalog"
  },
  "independentSequence": [
    {
      "case": "miss",
      "originCallsBefore": 0,
      "originCallsAfter": 1,
      "cacheKeysAfter": [
        "GET /catalog"
      ]
    },
    {
      "case": "hit",
      "originCallsBefore": 1,
      "originCallsAfter": 1,
      "cacheKeysAfter": [
        "GET /catalog"
      ]
    },
    {
      "case": "bypass",
      "originCallsBefore": 1,
      "originCallsAfter": 2,
      "cacheKeysAfter": [
        "GET /catalog"
      ]
    }
  ],
  "scope": "Owned selected policy; not a general RFC cache implementation or deployed CDN."
}

selectedKey: Local cache key selected only for the public catalog; not a parser for all HTTP cache-key rules.
originContacted: Whether this request performs an outbound origin exchange; equal bodies alone do not establish it.
originCallsBefore / After: Expected counter for the independent selected sequence; not a benchmark or production log field.
routeClass: The personal response bypasses shared lookup first and is relayed with no-store.

Numeric age and cache state are supplied fixtures. The native check observes selected public reuse/bypass between two owned plaintext loopback HTTP servers. No CDN, DNS/routing, TLS/certificate, authenticated user, or purge/failover is executed.

Two reality checks

A successful CDN response proves the origin processed this request.

A reusable HIT can complete without an origin exchange. Keep edge and origin observations separate.

Browser HTTPS establishes verified edge-to-origin delivery.

A TLS-terminating architecture has separate encryption and peer-verification boundaries for each hop.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

A public-catalog hit has age 5/lifetime 60. What does OriginCallsAfter show?

This hit produces no new origin call.
Every CDN response requires a new request to the origin.

Read the explained answer

This hit produces no new origin call. — originCallsBefore/After are 1/1 and originContacted=false; the selected public body is reused at the edge.

Why is personal /notes/mine absent from the public-cache key list?

Selected lesson artifact fields; teaching example

personal.cacheControl: no-store
personal.routeClass: bypass-before-lookup
independentSequence[2].cacheKeysAfter: ["GET /catalog"]

The CDN stores all personalized bodies publicly under one GET key.
The selected personal route bypasses cache lookup/storage.

Read the explained answer

The selected personal route bypasses cache lookup/storage. — Bypass calls the origin, but cacheKeysAfter retains only GET /catalog; supplied permission is separate.

The browser received a response from the CDN. Does that prove the origin is currently healthy and TLS is one end-to-end connection?

Read the explained answer

A fresh hit may return a body without contacting the origin; browser delivery does not measure current origin health. With selected CDN termination, browser–edge and edge–origin TLS contexts are separate. This fixture teaches cache decisions; it is not a deployed CDN or real-certificate measurement.

□ I did not count an edge hit as origin-health proof.

□ I did not equate hop TLS contexts with one connection.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

Cloudflare — What is a CDN?What is a CDN? · Is a CDN the same as a web host?
RFC 9111 — HTTP Caching1 Introduction: shared and private caches · 2 Overview of Cache Operation · 3 Storing Responses in Caches · 4 Constructing Responses from Caches · 4.2 Freshness · 5.2.2.5 no-store
Cloudflare — Full (strict) SSL/TLS encryption modesOverview: separate visitor/edge/origin encrypted hops · Use when: origin certificate requirements

YOUR NOTES / THIS BROWSER

CDN, edge, and origin relationships

1. Core · Mechanism

Public MISS

Public HIT

Personal bypass

Which server does Duru connect to?

Separate the origin role from a machine name

MISS: two exchanges and three owners

HIT: an idle origin matters

Keep personal responses out of public entries

Each TLS hop has its own trust boundary

2. Red · Trust & Impact

Public HIT

Hop evidence

Ask which owner supplied a body

First-hop success does not validate the entire chain

3. Blue · Secure development & defense

Call sequence

Origin gap

Write an explicit public-delivery contract

Check behavior at ownership boundaries

How do HIT, MISS and personal BYPASS differ in ownership and evidence?

Two reality checks

A public-catalog hit has age 5/lifetime 60. What does OriginCallsAfter show?

Why is personal /notes/mine absent from the public-cache key list?

The browser received a response from the CDN. Does that prove the origin is currently healthy and TLS is one end-to-end connection?

Sources and scope