Edge workers earn their place when a decision is small, deterministic, and needed on every request — or when a central round trip would add latency the viewer can feel. The patterns below are the ones that pay off most on high-scale adult platforms. Read Edge Workers overview first for the execution model.
Token validation and entitlement
Signed-URL and token checks are the canonical edge job. The worker parses the token, verifies the signature, checks expiry and scope, and either lets the request continue to cache or rejects it with 403. Keep the secret material in the runtime’s secret store, never in the worker bundle, and keep the check constant-time where the signature scheme allows it.
The design rule that matters for media: validate entitlement without polluting the cache key. If a per-viewer token becomes part of the cache key, every viewer is a miss and the cache becomes a pass-through. Validate the token at the edge, then derive the cache key only from fields that genuinely identify the object. See Cache control and cache keys.
Geo and policy decisions
Workers can branch on the viewer’s coarse geography, ASN, or network attributes before the request reaches the cache or origin. Use this for geo licensing windows, regional content restrictions, and jurisdiction-specific routing. Keep the decision table in edge KV or a small config object so you can change it without redeploying the worker. Age, consent, and lawful-availability rules remain your responsibility to define; the edge enforces what you specify.
Request normalisation
Origins break in predictable ways when they receive inconsistent input. A worker can canonicalise the path, collapse duplicate query parameters, sort the remaining ones, strip analytics and session noise, and fix Accept-Encoding or range headers. Normalisation is often the single highest-leverage cache fix: it makes requests that should be identical actually identical, raising hit ratio without changing content.
Hotlink protection
A worker can inspect Referer and other request signals and reject or redirect requests that embed your media from an unauthorised page. Treat this as deterrence, not a wall: Referer is spoofable, so pair it with signed URLs and token expiry for anything that costs you real egress. The economics and the limits are covered in Bot management and scraping.
Redirects and routing
Path rewrites, locale redirects, maintenance routing, and legacy-URL mapping all belong at the edge. A worker can redirect before the cache is consulted, which avoids caching a redirect for the wrong audience and avoids an origin hit for a URL you already know is obsolete. Return the right status — 301/308 for permanent, 302/307 for temporary — and be deliberate about preserving the method.
Experiments and lightweight personalisation
Workers can bucket a viewer deterministically from a stable input (a cookie, a hashed identifier, or a query parameter) and serve variant A or B. For media, the safe pattern is to vary the manifest or metadata, not the bytes, so the cache stays shared. Lightweight personalisation — a thumbnail order, a locale string, a badge — fits well; anything requiring a per-viewer database read usually belongs behind the cache, not in front of it.
Idempotency under shielding and retries
When you enable origin shielding and failover, a worker may execute more than once for what the viewer experiences as one request: a shielded fill can retry, and a client can retry a timed-out request. Make side effects idempotent. If a worker writes a counter, records an event, or triggers a purge, key the operation on a deterministic request identifier so a retry does not double-count. Read-modify-write against shared state is the classic failure: two concurrent fills can lose an increment. Prefer append-only events and let a downstream system aggregate.
Choosing where to run
| Pattern | Runs on request | Touches cache key | Needs shared state |
|---|---|---|---|
| Token validation | Yes | No | Secret only |
| Geo/policy branch | Yes | Sometimes | Config in KV |
| Normalisation | Yes | Yes (deliberately) | No |
| Hotlink rejection | Yes | No | No |
| Redirect | Yes | No | No |
| A/B bucketing | Yes | No | No |
| Event logging | Yes | No | Append-only |
Where AdultInfra fits
AdultInfra writes worker logic that stays inside the runtime budget and keeps the cache working, rather than turning the edge into a per-request origin proxy. Start from Edge Workers runtime and storage to understand the limits, or contact us with the request path you want to change.