If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing power.

To solve this we use a CDN. So when we hit the cache we don't need as much computing power and we don’t need to access the CMS. If we do user authentication on the site this becomes an issue because of the following.

Authentication allows a user to sign up for an account log in to that account. This will allow them to access special content, save and vote for content, and see personalized content.

When you are logged in, most pages of the website will remain the same, except for a few differences:

  1. You will see “Welcome ” in the header.
  2. The menu will have 3 additional links. “My Account”, “My Content”, and “Logout”.

A typical login implementation might look like this:

  1. Ask for email and password.
  2. Post email and password over https to the application.
  3. The application sets an encrypted session cookie with the user id.
  4. Future requests to the application will include the cookie so that it can determine if someone is logged in and who it is.
  5. The header will be customized accordingly in the application.

The problem with this implementation is that in order for it to work you will need to access the web server every time for every page, therefore eliminating the CDN and the value that it provides.

This seems unnecessary because as stated earlier the website will remain mostly the same even when you are logged in.

Are there ways to take advantage of a CDN, yet still provide the login functionality that we’re looking for?

closed as off-topic by Steffen Ullrich, user10008, Xander, user45139, Stephane Oct 21 '15 at 6:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, user10008, Xander, Community, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.


A CDN is a Content Distribution Network - that is it distributes content it gets from a single source. Good content for a CDN is static (images, CSS, ...) and the CDN will not handle any authentication (except sometimes a client-based TLS one), nor application logic.

As you mention

Future requests to the application will include the cookie so that it can determine if someone is logged in and who it is.

so there is traffic which needs to go to the server to handle checks against authorization rules.

A possibility would be to simply move your server to the cloud and scale it there.

Not the answer you're looking for? Browse other questions tagged or ask your own question.