Hosting & CloudGlossaryPart 12 of 17
The Edge Glossary
117 terms from the Hosting & Cloud book's The Edge part, each defined in a line and linked to the chapter that explains it.
- 0-RTT: TLS 1.3 early data that lets a returning client send a request in its first flight, which can be replayed, so it stays off until the origin handles replay (TLS & Protocols at the Edge).
- 421 Misdirected Request: the status a server returns when a request arrives on a reused connection it doesn't want to serve for that hostname (TLS & Protocols at the Edge).
- 425 Too Early: the status an origin returns for a request sent as early data that it won't risk replaying (TLS & Protocols at the Edge).
- AI traffic monetization: AWS WAF's feature on CloudFront that answers a monetized resource with a 402 carrying pricing and accepted payment networks, so crawlers can pay for access (WAF, Bots & Rate Limits).
- Akamai (Prolexic): Akamai's DDoS scrubbing network, receiving customer traffic by routed GRE or BGP diversion, cleaning it and forwarding the rest (DDoS Mitigation).
- Alt-Svc discovery: how a client learns that an edge offers HTTP/3: the first TCP response advertises it in an
Alt-Svcheader, or an HTTPS DNS record announces it (TLS & Protocols at the Edge). - Amazon CloudFront: AWS's CDN, sold pay as you go, on flat-rate plans or with a savings bundle, with DNS-based steering to its POPs (The Edge Business).
- Amplification limits (QUIC): QUIC's rule that a server may send only a small multiple of the bytes it received before the client's address is validated, which stops it being used as a reflector (TLS & Protocols at the Edge).
- Anomaly scoring: the OWASP Core Rule Set's approach in which matching rules add their severity to a running score instead of blocking, and the request is blocked only when the score crosses a threshold (WAF, Bots & Rate Limits).
- Anycast: every location announcing the same addresses in BGP so internet routing picks the location for each packet, which spreads attacks across locations (Networks, Peering & IP Addresses).
- Attestation (bots): a device vendor vouching for a client instead of the site interrogating it, as with Private Access Tokens (WAF, Bots & Rate Limits).
- Authenticated origin pulls: mutual TLS from edge to origin, the edge presenting a client certificate so the origin can prove a request came through the edge (TLS & Protocols at the Edge).
- AWS Shield: AWS's DDoS protection: Standard on CloudFront, Route 53 and load balancers at no charge, Advanced per payer account with credits for attack-driven charges (DDoS Mitigation).
- AWS WAF: AWS's WAF of web ACLs made of rules and rule groups (AWS Managed Rules, Marketplace sellers, the customer's own), measured in WCUs (WAF, Bots & Rate Limits).
- Azure DDoS Protection: Azure's L3/4 DDoS protection, sold per virtual network (Network Protection) or per public IP (IP Protection) (DDoS Mitigation).
- Azure Front Door: Microsoft's CDN and edge, sold in Standard and Premium tiers plus usage (The Edge Business).
- Azure Front Door WAF: Front Door's WAF of a Default Rule Set with anomaly scoring, a Bot Manager rule set and custom rules, with a Detection mode before blocking (WAF, Bots & Rate Limits).
- BCP 38: the practice of a network dropping outgoing packets whose source address isn't one of its own prefixes, which eliminates source address spoofing at its origin (DDoS Mitigation).
- BGP diversion: a protector announcing a customer's own prefix from its network so all its traffic passes through scrubbing, always on or only during an attack (DDoS Mitigation).
- Bot score: a per-request likelihood of automation computed from many signals, against which customers write rules; the scales differ by provider (WAF, Bots & Rate Limits).
- Bought IPv4: IPv4 space transferred through an RIR and owned, which amortizes against leasing (Networks, Peering & IP Addresses).
- Bunny: a low-cost CDN priced per GB by region on a standard network or flat on a volume network, with no request fees (The Edge Business).
- Bunny (Shield): Bunny's edge security product combining WAF, rate limiting, bot detection and DDoS protection at the CDN edge (DDoS Mitigation).
- BYOIP: bringing a customer's own IP prefix to a provider, which announces it once control is proven through the RIR's records and a letter of authorization is on file (Networks, Peering & IP Addresses).
- Byte hit ratio: bytes served from cache over bytes served, the hit ratio that maps to the origin's egress bill (Caching & Invalidation).
- Cache key: what makes two requests the same cached object (host, scheme, query strings, headers, cookies, device class), kept separate from what is forwarded to the origin (Caching & Invalidation).
- Cache poisoning: an attack that sends an input the cache doesn't key on but the origin reflects, so a harmful response is cached and served to everyone (Caching & Invalidation).
- Cache policy: CloudFront's object defining the cache key, paired with an origin request policy for what the origin receives (Caching & Invalidation).
- Carpet bombing: a flood spread across many destination addresses or ports so per-target thresholds don't trip (DDoS Mitigation).
- Characteristics (rate limiting): the key a rate-limiting rule counts by, such as IP, ASN, country, header, cookie, path, JA3/JA4 or a body field (WAF, Bots & Rate Limits).
- Cloud-attached CDN: a CDN in front of the same cloud's origins (CloudFront, Cloud CDN, Front Door), with free or cheap origin fill (The Edge Business).
- CloudFront flat-rate plans: CloudFront plans that bundle CDN, WAF, DDoS protection, DNS and edge compute per distribution for a monthly price with request and transfer allowances (The Edge Business).
- CloudFront Security Savings Bundle: a one-year monthly spend commitment that discounts all CloudFront usage, including Functions and Lambda@Edge, and includes AWS WAF usage (The Edge Business).
- Clustering: forwarding each object's fetch to the one server in a POP responsible for it, so request collapsing works across the whole POP (Caching & Invalidation).
- Connection reuse (coalescing): a client sending requests for another hostname over an existing HTTP/2 or HTTP/3 connection when the server's certificate is authoritative for it (TLS & Protocols at the Edge).
- Contract with commitment: CDN pricing at a negotiated rate with a minimum commitment (Akamai, enterprise tiers everywhere) (The Edge Business).
- Counters are local: edge rate-limit counters are kept per data center, so a limit applies per location a client reaches, not across the network (WAF, Bots & Rate Limits).
- Credited after the fact: the DDoS billing model in which attack-driven charges are billed and then credited on request (AWS Shield Advanced, Azure DDoS Network Protection) (DDoS Mitigation).
- Custom hostnames for SaaS: an edge product that terminates TLS for a SaaS platform's customers' own domains under the platform's account, through claim, proof of control, issuance, serving and release (TLS & Protocols at the Edge).
- Custom rules (WAF): the customer's own WAF rules: IP and country lists, path and header matches, size constraints, method restrictions and bot conditions (WAF, Bots & Rate Limits).
- Dedicated IP certificates: one address per certificate for clients that don't send SNI, sold at a high monthly price (TLS & Protocols at the Edge).
- DNS-based steering: the provider's authoritative DNS answering each lookup with the address of a location chosen for the resolver that asked (Networks, Peering & IP Addresses).
- Edge assembly: caching page fragments separately and assembling them per request at the edge (ESI or edge functions), so personal pages can still use the cache (Caching & Invalidation).
- Edge compute: code run at the CDN's locations, priced on requests and CPU time rather than bytes, the revenue line every edge provider is growing into (The Edge Business).
- Egress can't be anycast: traffic an edge sends on a customer's behalf needs replies to return to the sending server, so it can't use anycast addresses (Networks, Peering & IP Addresses).
- Embedded capacity: a content network's servers placed inside an access network, so traffic never crosses an interconnect, serving only that network's customers (Networks, Peering & IP Addresses).
- Exceptions (WAF): rules that skip a managed rule for a given path or condition, taking priority over overrides (WAF, Bots & Rate Limits).
- Excluded at metering: the DDoS billing model in which attack traffic never reaches the bill because it is excluded before rating (Fastly DDoS Protection) (DDoS Mitigation).
- Executing and blocking paranoia levels: CRS's separation of the level of rules that run from the level that counts toward the anomaly score, so higher-level rules can be measured before they block (WAF, Bots & Rate Limits).
- Fastly packages: Fastly's monthly-priced bundles with included requests, turning usage into a fixed price (The Edge Business).
- Flat-rate plan (CDN): a monthly price with allowances instead of metered bytes and requests (Cloudflare, CloudFront flat rate, Fastly packages), limited by a content rule rather than a meter (The Edge Business).
- Google Cloud Armor: Google's protection at its edge in front of its load balancers, automatic at L3/4 and with security policies and preconfigured WAF rules at L7 (DDoS Mitigation).
- Google Cloud CDN: Google's CDN behind the global external Application Load Balancer, on global anycast addresses, billed by usage (The Edge Business).
- Google Global Cache: Google's embedded caches, for which Google provides the hardware and the ISP provides space, power, a connection and a BGP feed (Networks, Peering & IP Addresses).
- Hijack (routing): a network originating a prefix it doesn't hold, redirecting traffic for someone else's addresses (Networks, Peering & IP Addresses).
- Hit-for-pass: a marker left when a response can't be shared, so later requests stop queueing behind a collapsed fetch (Caching & Invalidation).
- HTTP/2 Rapid Reset: an attack that opens and immediately cancels HTTP/2 streams, so the server does work for each while cancelled streams don't count against the concurrency limit (DDoS Mitigation).
- Invalidation (Cloudflare): Cloudflare's soft purge, which marks content stale so it is revalidated on the next request and reused if unchanged (Caching & Invalidation).
- Invisible challenges: bot checks run as small JavaScript probes without a puzzle, such as Turnstile (WAF, Bots & Rate Limits).
- IoT botnets: botnets of compromised real devices that complete handshakes, such as Mirai, which made attack sources look like ordinary clients (DDoS Mitigation).
- IPv6-first with shared IPv4: IPv6 everywhere and IPv4 only shared or by SNI, which removes most address cost (Networks, Peering & IP Addresses).
- Leak (routing): a network passing on routes it should have kept to itself (Networks, Peering & IP Addresses).
- Leased IPv4: IPv4 addresses rented from a holder, with no capital outlay but the lessor's reputation history inherited (Networks, Peering & IP Addresses).
- Low-cost per-GB network: a CDN selling very low per-GB prices with no request fees (Bunny standard and volume) (The Edge Business).
- Managed rulesets: WAF rules written and updated by the provider or a third-party seller, which the customer controls only through overrides and exceptions (WAF, Bots & Rate Limits).
- MANRS: a routing-security initiative supported by the Global Cyber Alliance, asking networks to take four actions starting with filtering (Networks, Peering & IP Addresses).
- Match Viewer: CloudFront's origin protocol setting under which one cached copy serves both HTTP and HTTPS requests (Caching & Invalidation).
- Metered usage (CDN): CDN pricing per GB by region and volume tier plus requests (CloudFront, Fastly, Cloud CDN, Front Door) (The Edge Business).
- Mitigation timeout: how long a rate-limiting rule's action lasts once it triggers (WAF, Bots & Rate Limits).
- Multi-CDN: traffic split across two or more CDNs by a steering layer, for price leverage and resilience (The Edge Business).
- Net retention: revenue from last year's customers now over their revenue then, a metric each edge provider defines its own way (The Edge Business).
- Netflix Open Connect: Netflix's program offering ISPs free embedded appliances in their data centers or peering at exchanges (Networks, Peering & IP Addresses).
- Never metered: the DDoS billing model in which attack size can't affect price because bandwidth isn't the plan's meter (Cloudflare plans) (DDoS Mitigation).
- Origin certificates: certificates from a provider-run private CA for the edge-to-origin leg, valid only between the edge and the origin (TLS & Protocols at the Edge).
- Origin fill: the transfer from origin to edge when the cache misses, billed by some providers and free from same-cloud origins at others (The Edge Business).
- Origin offload: one minus origin requests (or bytes) over edge requests (or bytes), the metric that maps to origin capacity (Caching & Invalidation).
- Origin request policy: CloudFront's object defining what the origin receives, separate from the cache key (Caching & Invalidation).
- Override (WAF): the customer's control over a managed ruleset, changing an action or disabling rules at the ruleset, tag or rule level rather than editing the rules (WAF, Bots & Rate Limits).
- Own delivery network: caches in rented colocation and inside access networks, the lowest-cost delivery for the largest content companies (The Edge Business).
- Paranoia levels: the OWASP CRS setting that decides which rules run, from level 1 baseline protection with few false positives to level 4 for critical assets (WAF, Bots & Rate Limits).
- Pay per crawl: Cloudflare's feature letting a publisher Allow, Charge or Block each crawler with a flat per-request price, Cloudflare acting as Merchant of Record (WAF, Bots & Rate Limits).
- Peering: two networks exchanging traffic between their own customers directly, usually settlement-free, at exchanges or over private interconnects (Networks, Peering & IP Addresses).
- PeeringDB: the free public directory, run by volunteers, where networks publish their ASNs, peering policies, exchanges and facilities (Networks, Peering & IP Addresses).
- POP counts: the location numbers CDNs publish, which don't compare because units, designs and capacity claims differ, so they are treated as claims (Networks, Peering & IP Addresses).
- Pricing region: the region delivery is priced by, where the serving location sits, the main driver of CDN cost (The Edge Business).
- Private network interconnect (PNI): a dedicated cable between two networks' routers in the same building, used when traffic between them is large enough to fill ports (Networks, Peering & IP Addresses).
- Purge methods: the ways an edge invalidates cached content: by URL, tag (surrogate key), prefix, hostname or everything (Caching & Invalidation).
- Reflection and amplification: an attack sending small UDP requests with the victim's address forged as the source, so third-party servers send their larger answers to the victim (DDoS Mitigation).
- Remote signing (Keyless): running the TLS handshake's private-key operation on the customer's own key server, so the edge never holds the key (TLS & Protocols at the Edge).
- Remotely triggered blackholing (RTBH): the attacked network announcing the target address with the BLACKHOLE community so neighbors drop all traffic to it, which protects shared links but takes the address offline (DDoS Mitigation).
- Request collapsing: an edge holding concurrent requests for the same cache key while the first fetch is in flight and answering them all from one response (Caching & Invalidation).
- Request hit ratio: edge hits over all cacheable requests, inflated by collapsed requests and tiny objects (Caching & Invalidation).
- Revalidation: replacing a full fetch with a conditional one (
If-None-MatchorIf-Modified-Since) that the origin answers with a304and no body when unchanged (Caching & Invalidation). - Route origin validation: routers checking each BGP announcement against validated ROAs and marking it valid, invalid or not found (Networks, Peering & IP Addresses).
- RPKI and ROAs: the resource PKI in which an address holder signs a Route Origin Authorization allowing a single AS to originate routes to its prefixes, with an optional maximum length (Networks, Peering & IP Addresses).
- Scrubbing centers: a few large locations with filtering capacity that receive a customer's traffic, clean it and forward the remainder (DDoS Mitigation).
- Shield (origin shield): an upper cache tier near the origin that edge caches ask first, so the origin sees roughly one miss in total, at an extra per-request charge at some providers (The Edge Business).
- SNI: the TLS extension that lets clients reach many virtual servers on one address, so the edge picks the certificate and per-hostname settings by name (TLS & Protocols at the Edge).
- Soft versus hard purge: a hard purge makes objects unusable so the next request goes to the origin; a soft purge marks them stale so they can still be served while revalidating or when the origin is down (Caching & Invalidation).
- Soft-unicast: Cloudflare's egress design of one IPv4 address per data center shared by its servers through port slicing (Networks, Peering & IP Addresses).
- Stale serving: serving an expired copy for availability, with
stale-while-revalidaterefreshing it in the background andstale-if-errorcovering origin errors (Caching & Invalidation). - SYN cache: a SYN-flood defense that keeps a small hashed table of half-open connections and evicts the oldest per bucket (DDoS Mitigation).
- SYN cookie: a SYN-flood defense in which the server allocates nothing for a half-open connection and encodes what it needs in the sequence number it sends back (DDoS Mitigation).
- SYN flood: an attack that sends SYNs, usually spoofed, and never completes the handshake, filling the backlog so real clients can't connect (DDoS Mitigation).
- Throttle versus block: the rate-limiting choice between allowing requests up to the limit and acting on the excess, and blocking a client entirely once it crosses the threshold (WAF, Bots & Rate Limits).
- Tiered caches: a second cache tier the edge caches ask before the origin, cutting origin load but making purges cover two tiers and adding inter-tier traffic to the bill (Caching & Invalidation).
- TLS fingerprints: identifiers of client software from how it opens a TLS connection, such as JA3's hash of the ClientHello and JA4's sorted variant (WAF, Bots & Rate Limits).
- TLS terminated at the origin: L4 pass-through in which the edge forwards TCP or QUIC without decrypting, so the edge can't cache or inspect (TLS & Protocols at the Edge).
- Transit: paying an upstream network to carry traffic to every destination on the internet, universal and simple but billed by capacity used (Networks, Peering & IP Addresses).
- UDP flood: a volumetric attack of UDP packets with any payload to any port, which needs no handshake and fills the target's link (DDoS Mitigation).
Vary: the origin's response header naming which request headers changed the response, so the cache keeps separate variants (Caching & Invalidation).- Verified bots: the allowlist of bots transparent about who they are and what they do, verified by published IP lists, reverse DNS or Web Bot Auth (WAF, Bots & Rate Limits).
- Versioned URLs: content-hashed asset names with long lifetimes that are never purged, preferred over invalidation for deploys because they also reach browser and proxy caches (Caching & Invalidation).
- Virtual patching: a WAF rule matching an exploit's shape, shipped in a managed ruleset with a default action to buy time for the real fix, which it never replaces (WAF, Bots & Rate Limits).
- Volume tier: the falling per-GB price bands within a month at most CDNs (The Edge Business).
- Web Bot Auth: a scheme in which a crawler signs each request with HTTP Message Signatures so the edge can know who it is, which charging for crawls requires (WAF, Bots & Rate Limits).
- Web cache deception: an attack that gets a logged-in victim to open a private page under a static-looking suffix (such as
/account/foo.css), so the edge caches and shares the private response (Caching & Invalidation).