Azure CDN and Caching Headers

Azure Content Delivery Network (CDN) is a global network of servers (edge nodes) that cache content from your origin (e.g., Azure Storage, Web App) and serve it to users from the nearest location. This reduces latency, offloads origin traffic, and improves user experience. The exam focuses on understanding CDN profiles, endpoints, caching rules, and how to control caching behavior via HTTP headers.

When a user requests a resource (e.g., an image) from a URL that points to a CDN endpoint, the DNS resolves to the nearest edge server (based on the user's IP). The edge server checks its cache:

The caching behavior is controlled by HTTP headers set by the origin, primarily Cache-Control and Expires. The CDN also respects Pragma, Last-Modified, and ETag for validation.

- CDN Profile: A collection of CDN endpoints. You can have multiple profiles (e.g., for different environments). - CDN Endpoint: A specific endpoint like https://myendpoint.azureedge.net. Each endpoint has a configuration, including origin, caching rules, and compression settings. - Caching Rules: Can be set at the endpoint level or per path/extension. You can define: - Query string caching: Ignore, bypass, or cache every unique URL. - Default cache behavior: Override the origin's Cache-Control headers. - Default TTL: If no caching headers are set, the CDN uses a default TTL of 7 days for general web delivery and 1 day for Azure Storage blobs. For Azure CDN Standard from Microsoft (Verizon/Premium), the default is 7 days. - Cache purge: Remove cached content across all edge nodes. You can purge by path, wildcard, or root. Purge propagation takes time (up to 10 minutes for Azure CDN Standard from Microsoft).

To create a CDN profile and endpoint via Azure CLI:

az cdn profile create --name MyProfile --resource-group MyRG --sku Standard_Microsoft
az cdn endpoint create --name MyEndpoint --profile-name MyProfile --resource-group MyRG --origin www.example.com

To set caching rules:

az cdn endpoint update --name MyEndpoint --profile-name MyProfile --resource-group MyRG --set deliveryPolicy.rules[0].conditions[0].name=UrlPath --set deliveryPolicy.rules[0].conditions[0].parameters.operator=Equals --set deliveryPolicy.rules[0].conditions[0].parameters.matchValues[0]=/images/*

To verify caching headers, use curl -I:

curl -I https://myendpoint.azureedge.net/image.png

Look for Cache-Control: public, max-age=31536000 or Age: 123 header indicating how long the resource has been cached.

- Cache-Control: The primary header. Values include: - public: Any cache may store. - private: Only browser cache, not CDN. - no-cache: Must revalidate with origin. - no-store: Do not cache at all. - max-age=<seconds>: Maximum time to cache. - s-maxage=<seconds>: Overrides max-age for shared caches (like CDN). - Expires: HTTP-date (e.g., Expires: Wed, 21 Oct 2025 07:28:00 GMT). If both Cache-Control: max-age and Expires are present, max-age takes precedence. - Last-Modified: The origin sends this; CDN can use it for conditional requests (If-Modified-Since). - ETag: A unique identifier for a version; CDN can use it for If-None-Match.

You can configure how CDN handles query strings: - Ignore query string: Cache a single version regardless of query string. Example: ?v=1 and ?v=2 serve the same cached object. - Bypass caching for query string: Do not cache any URL with query strings. - Cache every unique URL: Treat each query string as a separate cache entry. - Standard_Microsoft SKU: Only supports Ignore or Bypass. For Cache every URL, use Verizon or Akamai SKU.

Azure CDN can compress responses (gzip, brotli) to reduce bandwidth. Compression is enabled by default for certain MIME types. You can customize compression settings.

You can allow or block countries based on the request's IP. This is configured per endpoint path.

An e-commerce company with users worldwide uses Azure CDN to serve product images, CSS, and JavaScript. The origin is an Azure App Service in the US East region. Without CDN, users in Asia experience 200-300ms latency. With CDN, latency drops to 20-30ms. They configure caching rules: images are cached for 30 days (Cache-Control: public, max-age=2592000), CSS/JS for 7 days, and HTML for 1 hour (since product prices change frequently). They also enable query string caching for versioned files (e.g., style.css?v=2). A common problem: after a product image update, the old image remains cached. They solve this by purging the specific image path after upload. They also use geo-filtering to block access from certain countries due to licensing restrictions.

A video streaming service uses Azure CDN to deliver video chunks (MP4, HLS). The origin is Azure Blob Storage. They set Cache-Control: public, max-age=86400 on blobs to cache for 24 hours. To handle hot content, they pre-load popular videos during off-peak hours using the pre-load feature (Verizon SKU). They also enable compression for manifest files. A misconfiguration: they initially set Cache-Control: no-cache on video files to ensure freshness, but that caused high origin load. They changed to max-age=3600 with revalidation using ETag. They also use purge to invalidate stale content after encoding errors.

A software company distributes installer files via Azure CDN. Installers are large (1-2 GB) and rarely change. They set Cache-Control: public, max-age=31536000 (1 year) and use versioned filenames (e.g., setup-2.0.exe). This ensures users always get the correct version. They also enable compression for smaller files. A common issue: when a new version is released, they must purge the old version's path to force cache refresh. They learned to purge before the release to avoid stale downloads. They also use custom domain with HTTPS to secure downloads.