Reverse proxy role
Sits in front of origin servers: terminates TLS, load-balances, rate-limits, caches, adds headers (X-Forwarded-For, X-Request-ID). Clients see the proxy; origins see internal network.
nginx, Envoy, HAProxy, cloud ALB — same pattern, different ops model.
Connection pooling (high ROI for interviews)
Opening TCP+TLS per request is expensive. Proxies maintain pools of warm connections to upstreams (keep-alive). Cold start latency vs warm — explains why first request after idle is slow and why Connection: close hurts throughput.
CDN architecture
Edge PoPs cache static (and sometimes dynamic) content close to users. Origin shielding — collapse traffic so origin sees fewer requests. Cache key = URL + relevant headers (Vary).
| Pattern | Behavior |
|---|---|
Long max-age | Fast, risk stale content |
| Short TTL + ETag | Revalidate often, save bandwidth on 304 |
no-store | Never cache (PII, personalized) |
| Purge API | Invalidate after bad deploy |
Senior signals
- TLS terminates at CDN — origin may be HTTP inside VPC; know where trust boundaries are.
- Cache stampede — many clients miss at once; mitigate with request coalescing, stale-while-revalidate.
- Dynamic content at edge — edge workers change the model; still HTTP semantics underneath.
What to skip for interviews
Full CDN contract negotiation, multi-CDN failover runbooks, and origin pull optimization — system design territory, not networking trivia.
Further Reading
Hands-On Tasks (Optional)
Low-setup exercises you can run locally or on a free-tier cloud account. No autograding — the goal is to build intuition, not pass a test.
- Audit Cache-Control on a public API15m
Pick an API you use. `curl -sI <url>` and note Cache-Control, ETag, Age, and CF-Cache-Status or X-Cache if present. Decide if responses are cacheable at the edge.