Does a Content Delivery Network (CDN) interrupt end-to-end security?

A content delivery network must have access to the content, so it can optimize delivery through caching, compression etc. With true end-to-end encryption between the browser and the web server it is not possible that the CDN in between gets access to the content. Therefore the CDN itself must be that endpoint of the encryption, i.e. the connection is only secured between browser and CDN and the CDN has access to the unencrypted data from client and server. If the connection between CDN and server is then encrypted again or if is unencrypted depends on the setup and you will find both cases in practice.

Note that a load balancer is different from a CDN because it does not need access to the content. Therefore it can simply pass through the TLS connection to the server, so you get end-to-end security. But in practice load balancers are often combined with SSL offloading so that you don't have end-to-end security again. But since load balancers are (contrary to CDN) usually in the same local network as the servers this is not that much of a problem.


A CDN needs to decrypt content and cache it unencrypted (compression is another story). If you're using a CDN for static content, only files like CSS, PNG, etc. will be delivered from the CDN, but not dynamic data like the login credentials. Most CDN (like KeyCDN) let you choose whether the connection between the origin server and the CDN should be encrypted as well. The setup will then look like this:
Origin Server --HTTP(S)--> CDN(cached unencrypted) --HTTP(S)--> User

Tags:

Tls