What can go wrong when caching an API in a CDN?
Answer out loud or in your head first, then compare.
Answer
A CDN can serve the wrong copy if it doesn't distinguish all the conditions that affect the result. Example: the response depends on the user or company, but the cache key only includes the URL. Then one person's private data can be seen by others.
So I establish what is public, which headers and parameters change the result, and when a copy expires. I check the behaviour for two different users and after the data changes. CORS, i.e. the rules for a browser's access to responses from another origin, doesn't replace the backend's authentication or authorisation. With redirects I also remember that some responses may be cached longer than I planned.
Why it matters: Connects cache basics with practical edge risk.
Possible follow-ups: Does the absence of cookies always mean a response is public?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- E-P01 · What is cloud computing? — AWS, Cloudflare and infrastructure
- E-P03 · What is Cloudflare, and what is it for? — AWS, Cloudflare and infrastructure
- E-P04 · How does Cloudflare differ from AWS? — AWS, Cloudflare and infrastructure
Further reading
- Next.js: Caching and Revalidating (Previous Model)(opens in a new tab)Docs; accessed 22.10.2026. Depends on the router, version and Cache Components; there is no single rule for all of Next.