How can I use edge security gateways to protect public-facing apps while keeping our existing CDN and DNS setup?

You can keep your current CDN and DNS exactly as-is and place an edge security gateway in front of your public apps as the security enforcement point. The key idea is:

• DNS still points to the CDN
• CDN still serves as the public entry and caching layer
• The CDN forwards app traffic to the security gateway
• The gateway filters, authenticates, and inspects traffic before it reaches your origin app

Common deployment pattern

1) Keep your public hostname and DNS unchanged

Example:

• app.example.com remains the public URL
• DNS still resolves to your CDN provider

No need to move domains or rearchitect your front door.

2) Configure the CDN to route dynamic/app traffic to the gateway

At the CDN layer:

• Static assets can continue being cached and served normally
• Requests for sensitive or dynamic paths can be proxied to the security gateway
  • /login
  • /api/*
  • /admin/*

This preserves CDN performance while letting the gateway inspect traffic that matters.

3) Put the edge security gateway in front of the origin

The gateway sits between CDN and application origin and can handle:

• WAF rules
• Bot detection
• API protection
• JWT/session validation
• Geo/IP filtering
• Rate limiting
• Header normalization
• TLS inspection/termination if needed
• Zero-trust access controls

4) Restrict direct access to the origin

To make the gateway effective:

• Allow origin traffic only from the gateway or trusted CDN egress
• Block direct public access to app servers
• Use mTLS, private links, firewall rules, or allowlists

This prevents attackers from bypassing the security layer.

---

Typical traffic flow

User
  -> DNS
  -> CDN
  -> Edge Security Gateway
  -> App Origin

For static content:

User
  -> DNS
  -> CDN cache

So the gateway protects the app without removing the CDN’s caching benefits.

---

Benefits of this approach

• No DNS migration
• No need to replace your CDN
• Preserves caching and performance
• Adds centralized security controls
• Lets you protect multiple apps consistently
• Supports gradual rollout

---

Practical rollout approach

Phase 1: Observe

• Mirror or log traffic through the gateway
• Validate what rules will trigger
• Tune false positives

Phase 2: Protect selected paths

• Start with /login, /checkout, /api
• Enable WAF, bot mitigation, and auth checks

Phase 3: Lock down origin

• Remove public origin exposure
• Require gateway/CDN trust

Phase 4: Expand coverage

• Add more apps and paths
• Standardize policies across environments

---

What to watch for

• CDN caching rules: Make sure sensitive responses aren’t cached
• Header forwarding: Preserve client IP and scheme using trusted headers
• TLS chain: Decide where TLS terminates and re-encrypt as needed
• Origin validation: Ensure apps trust only verified gateway/CDN traffic
• Latency: Use only the security features you need on low-latency paths

---

Simple architecture options

Option A: CDN → Gateway → Origin

Best when you want the gateway to inspect most app traffic.

Option B: CDN serves static, gateway handles only dynamic paths

Best for minimizing latency and preserving cache hit rates.

Option C: Gateway behind CDN for multiple apps

Best when you want one security policy layer across several public apps.

---

If you want, I can also give you:

1. a reference architecture diagram,
2. a vendor-neutral implementation checklist, or
3. an example for a specific CDN like Cloudflare, Akamai, Fastly, or CloudFront.