At adult-video scale, the expensive incidents are rarely a simple outage. They are cache-integrity, invalidation, and routing edge cases that only appear under range-heavy, token-gated, high-QPS traffic. These are the ones worth designing and testing against explicitly.
Range edge cases can silently double origin egress
Byte-range delivery has sharp corners. If a client issues non-ascending, overlapping, or malformed ranges, some CDNs forward the request to origin or return the whole object instead of the requested slice; if the origin responds with Transfer-Encoding: chunked, the CDN may also return the entire object. For compressed objects, byte ranges refer to the compressed size, not the source size, so slice math can be wrong by construction. Players that fire many small, out-of-order ranges can therefore turn a "range" workload into full-object origin egress. Normalize and order ranges, and treat range behavior as a measured metric, not an assumption.
Very large objects must be sliced to be cacheable
Some CDNs refuse to retrieve or cache a single object above a fixed ceiling (for example, 50 GB) and error to the viewer if Content-Length exceeds it. Masters, mezzanine files, and large progressive MP4s above that size are effectively origin-fetched on every play unless clients request them in sub-ceiling range pieces that cache independently. This shapes archive and VOD architecture before it shapes cache tuning.
A purge is not always a miss
Invalidation semantics differ by CDN and by storage tier. A "soft" purge marks content stale and serves it while a fresh copy is fetched, which avoids a self-inflicted origin stampede when a hot object is hard-purged and every POP refills at once. But soft purge depends on validators or stale-while-revalidate being configured. On some tiers a tag or prefix purge only forces revalidation on the next request rather than a hard miss, and a persistent cache layer may retain the object for a fixed window regardless of TTL, resetting that window on every read. A takedown or rights expiry must therefore invalidate the full derivative lineage: storage, every cache tier, search index, thumbnails, and sprites, not the edge alone.
Surrogate keys have limits that fail silently
Tag- and surrogate-key-based purge is the scalable way to remove a performer, studio, or rights-expired asset, but the tags travel in a header with hard size limits: individual keys are capped around a kilobyte and the aggregate header around 16 KB, with keys beyond the limit ignored. At catalogue scale, a "ban this studio" operation can quietly fail to cover the objects you think it does. Test for silent tag truncation before relying on tag purge for takedowns.
Keep per-viewer telemetry out of the cache key
CMCD, the player-side QoE telemetry standard, can ride on media requests as either a query parameter or a header. If it is carried in the query string and the CDN does not strip or ignore it, every viewer's request becomes a unique object and a 95% byte-offload cache collapses toward origin pass-through. Header-based CMCD avoids fragmenting the key but must be forwarded consistently across the CDN and origin. Either way, cache-key hygiene and telemetry are one design decision, not two.
Low-latency segments can poison a POP
When streaming begins before an object is fully received, caches have historically committed truncated segments after an upstream transmission error, then served that damaged object to other viewers, freezing playback at the same point for everyone. RFC 9317 documents this as the canonical cache-fill integrity bug for low-latency video. Caches must validate completeness against Content-Length and chunk framing before committing a segment, or one bad origin fetch becomes a regional incident.
Multi-CDN needs loop and safety primitives
Primary/overflow/DR steering is easy to misconfigure into a forwarding loop between two CDNs, which has been abused as a denial-of-service amplifier. CDN-Loop (RFC 8586) is the defense: each forwarding CDN appends to it so a request re-entering a CDN already in the chain can be detected and terminated. It only works if every intermediary preserves the header. Similarly, Cache-Status (RFC 9211) is the interoperable way to see whether requests actually collapsed (collapsed=?0 records a failed collapse) and why a cache went forward (stale, partial, or vary-miss), which is how stampedes get diagnosed rather than guessed at.
Cache deception and cache-busting attacks
Two edge-security failure modes matter for token-gated adult platforms. Cache deception requests a dynamic, personalized path with a static-looking suffix so the CDN caches a private response for everyone; defending requires verifying that the URL extension matches the response content type and preventing origin headers from overriding that check. Cache-busting DDoS does the inverse, forcing unique keys so every request reaches origin, and is the highest-impact application-layer attack on a video platform, so mitigation has to be inline and automatic rather than a human-triggered mode.