And who will do authentication process? CDN? And different domains can be an issue too.

> Further, a common method to reduce the risk of this is to place purely static public assets and user-specific private data on different domains.

In other words, "don't use CDN when you need cookies", fine.

A CDN is just a reverse proxy with caching. The "proxy" part means anything, including cookies, can be transferred from the end-user to your origin server.

There is no issue using CDNs with cookies.

No, CDN is content delivery network and it will not wait your server response on each request, otherwise it will kill whole point of CDN existence.

Yes, that's what the letters CDN stand for and is just a marketing term.

Technically, they are reverse proxies with a focus on caching, however that is not all they do. You can use them for various other features like security and front-end optimization and they work fine with cookies.

It's common to use a CDN for the entire site - caching static files at the edge while sending page requests to the origin server with all the cookies, especially important as many sites are now dynamic and customized to the individual. There is no issue in using a CDN to proxy all requests.

Maybe you have not noticed, but we were talking about authorized access to static files, using cookies. And I was talking you there's no point to use CDN if EVERY request will be send to main server (it will work even slower). Now you are trying to explain me that CDN can send SOME requests to main server (to dynamic pages), delivering static files from the nearest point to the user and without authentication by cookies.

I dont see where in this thread that became the topic, rather it's been about cookies in CDNs. You still seem to think that CDNs are only used for caching when that is just one of their features. You can also use them for security, for example, without using any caching at all.

If you need to authorize every single request (even to a static file) which means that every single request is unique, then this is obviously not a good use case for an edge server cache. You can still cache things in the browser with cache headers and continue using the CDN to proxy the full request with cookies to the origin. This doesn't add much latency and can sometimes decrease it because the CDN will keep faster connections open to the origin.

However, most CDNs today also offer their own access controls either with cookies or url tokens so you can do authorization at the CDN edge instead of the origin.

And yes, you can use the CDN to cache static files and just proxy requests to pages. Usually private information that requires authentication is in the webpage and the static files like javascript, css and images dont need protection.