Key Takeaways
- 01Edge platforms run code at the network perimeter, often within the request path. Latency wins are real; the security model deserves more thought than most teams give it.
- 02Properties to design around: per-request isolation shorter and stricter than typical containers, network access constrained to backends explicitly configured, memory and CPU limits that make some attack patterns infeasible, logging that must export in real time (no shell access).
- 03What belongs at the edge: authentication checks, request normalization, lightweight policy enforcement, A/B routing, CSP injection, bot mitigation pre-checks. The edge is excellent for these.
- 04What does not belong at the edge: anything reaching multiple backends with complex business logic, anything handling secrets you would not want in platform logging, anything requiring deep observability traces. Keep that in your origin tier.
Edge compute platforms run code at the network's perimeter, often within the request path. The latency wins are real; the security model deserves more thought than most teams give it.
The properties to design around
- 01Per-request isolation that is shorter and stricter than typical containers
- 02Network access constrained to backends explicitly configured
- 03Memory and CPU limits that make some attack patterns infeasible
- 04Logging that must be exported in real time — no shell access
What belongs at the edge
Authentication checks, request normalization, light-weight policy enforcement, A/B routing, content security policy injection, and bot mitigation pre-checks. The edge is excellent for these.
What does not belong at the edge
Anything that requires reaching multiple backends with complex business logic, anything that handles secrets that you would not want exported in the platform's logging, and anything that requires deep observability traces. Keep that in your origin tier.
#Edge#CDN#Lambda@Edge