A design platform's shared template suddenly goes viral, and one asset receives millions of requests within minutes. How should CDN caching, origin shielding, request collapsing, stale-while-revalidate and cache warming work together?

Why each mechanism alone is insufficient

CDN caching alone. Once the object is cached at each edge location, that location serves it cheaply. But the platform has many edge locations, and at the start of the event none of them have it. All of them miss simultaneously and all reach origin. The origin sees a burst proportional to the number of edge locations, not to the number of users — better than a million requests, and still far beyond what it was sized for.

Request collapsing alone. Within one edge node, concurrent misses for the same object collapse into a single upstream fetch. Excellent, and it still leaves each of several hundred edge nodes making its own request.

Origin shielding alone. Routing edge misses through a small set of parent caches reduces the fan-in to a handful of requests. But without collapsing at each tier, concurrent misses at the shield still multiply.

Stale-while-revalidate alone. Prevents the expiry stampede but does nothing for the initial cold population.

How they compose

1. Cache warming where the event is predictable — a scheduled launch, a featured template, a promotional campaign. Push the object to edge locations before demand exists. This is the only mechanism that eliminates the cold-start burst entirely, and it applies only to foreseeable events.
2. Request collapsing at every tier, so N concurrent misses at any node produce one upstream fetch.
3. Origin shielding, so hundreds of edge nodes fan into a small number of parents. Combined with collapsing, origin sees single-digit requests for a viral object.
4. Stale-while-revalidate, so once populated, expiry never causes a user to wait or a stampede to form — the edge serves the stale copy instantly and refreshes behind the request.
5. Jittered TTLs, so replicas do not expire in unison and recreate the stampede on a schedule.
6. Negative caching, because requests for a missing object otherwise bypass every layer and reach origin unimpeded — a common oversight that turns a broken link into an origin incident.

What must be true of the content

Immutability is what makes this work. Assets addressed by content hash can be cached effectively forever, so the only cost is the initial population. Mutable objects at the same URL require short TTLs or purge, and the whole design becomes harder.

The most valuable architectural decision here is upstream of the CDN: make user-facing assets immutable and versioned, so that changing an asset means publishing a new URL rather than invalidating an old one.

The origin's perspective

With this composition, origin load becomes proportional to the number of distinct objects being refreshed, not to request volume. That is a fundamentally different scaling relationship, and it is what allows a modest origin to sit behind an enormous edge fleet serving a viral event.

The failure to design against

An incomplete cache key. If the asset URL does not capture every dimension that varies the response — resolution, format, locale — the CDN either serves the wrong variant to millions of people or fragments the cache so badly that nothing is hot. During a viral event, both are catastrophic, and both are quiet until they are not.