CDN Origin Routing

CDN routing has two separate decisions: where a client connects and which origin the edge contacts. DNS and anycast choose an edge location; configuration at that edge chooses an origin and constructs the upstream request. Keeping those decisions separate makes failures easier to diagnose.

Request Identity at the Edge #

A client starts with a URL such as https://www.example.com/docs. DNS returns an edge address, TLS SNI identifies www.example.com during the handshake, and the HTTP request carries Host: www.example.com (or the equivalent :authority field in HTTP/2 and HTTP/3). The CDN uses this hostname and path to select a distribution and cache behavior.

An IP address alone is not an origin identity. Shared reverse proxies host many domains at one address, so a direct test must include the expected hostname:

curl --resolve www.example.com:443:203.0.113.10 \
  https://www.example.com/health

--resolve preserves the URL hostname for SNI and HTTP while selecting a specific address. It is safer and more representative than sending a raw IP URL with only a manually supplied header.

Forward the Correct Upstream Host #

The origin may use the incoming host to select a virtual host, generate redirects, or apply tenant policy. A CDN can preserve the viewer host, replace it with the origin hostname, or forward a configured value. Choose one intentionally:

viewer:  https://www.example.com/account
edge:    GET /account  Host: origin.internal.example.net
origin:  routes by Host and returns a response

If the origin TLS certificate names origin.internal.example.net, the CDN should use that name for upstream SNI and certificate validation. Forwarding www.example.com as HTTP Host is still possible when the origin needs it, but it should not weaken TLS verification.

Avoid Routing and Cache Surprises #

Keep the cache key, origin selection rule, and forwarded headers aligned. If /api/* goes to an API origin and /* goes to object storage, make the more specific rule take precedence. Include a tenant or locale in the cache key only when it changes the response; use separate hostnames or behaviors where that is clearer.

Protect the origin from direct traffic, log both viewer and upstream request IDs, and test redirects, WebSockets, health checks, and error paths through the CDN. An origin that works from an internal network may still fail at the edge because of DNS, SNI, firewall, or forwarded-host differences.