Skip to content

Security best practices on a CDN

ViaductCDN is a TLS-terminating CDN. So is Cloudflare, Fastly, Akamai, and every other major CDN. This page is honest about what that means in practice and what you can do at the application layer to mitigate exposure to the CDN itself.

For the threat-model deep dive, see /security on the marketing site.

Status: skeleton

Full content lands in a follow-up pass.

What every TLS-terminating CDN (including ours) sees

While bytes flow through us, in plaintext:

  • Full request URLs, including query strings
  • All HTTP headers (Authorization, Cookie, custom)
  • Request bodies (form POSTs, JSON payloads)
  • Response bodies

This is the trust position you accept by putting any CDN in front of your origin. We don't think we're unusually exposed; we think we're unusually direct about the exposure.

What we log to disk

Class Logged? Retention
Request and response bodies No n/a
Authorization and Cookie header values No n/a
URL path, status code, byte count, timing Yes 90 days
Client IP No for Tor (hashed circuit ID instead). For clearnet: hashed; raw IP held in volatile memory only for rate-limit decisions, never written. n/a

Mitigation: end-to-end encryption at the application layer

If your content is sensitive enough that "we see it in flight" is unacceptable:

  • Encrypt response bodies at the application layer with keys held only by clients (e.g., a JS bundle decrypts the body using a key derived from the user's password / passphrase / hardware token)
  • We see ciphertext; we cache ciphertext; readers see ciphertext over the wire and decrypt locally
  • We act as a dumb byte-pipe; the privacy story is now end-to-end against us, not just against external observers

This is unusual but not unprecedented. Standard Notes, ProtonMail's web client, and others ship JS that decrypts locally; the hosting infrastructure sees ciphertext only.

Mitigation: keep secrets out of cacheable URLs

  • Don't put bearer tokens in query strings; use headers instead
  • If you must put time-bound tokens in URLs, prefer signed URLs with stable cache keys (we strip the signature from the cache key automatically — see signed URLs)

Mitigation: minimize what flows through

  • Static, public content benefits most from a CDN; sensitive content benefits least
  • Consider routing sensitive APIs (login, account, payment) through a path that bypasses cache and skips header logging — contact support@viaductcdn.com for the configuration

Mitigation: origin-side defenses

  • Lock origin access to our egress IPs so misconfigured cache rules can't expose your origin directly
  • If you handle health-data or payment-card data with regulated baselines (HIPAA, PCI), the baseline almost certainly requires assessing your CDN as a subprocessor — we publish the subprocessor list on /transparency and a DPA is available on request