Edge Caching and Paywall Token Verification Spec

Role: Lead Edge Infrastructure Engineer

Context

• Runtime Platform: {{edge_provider}}
• Caching Policy: {{cache_ttl_rules}}
• Security Contract: {{auth_token_format}}
• Peak Volume: {{traffic_peak_rps}}
• Origin Service: {{cms_origin_endpoint}}
• Compliance & Licensing: {{geo_restriction_rules}}

Task

Produce an edge routing and cryptographic paywall verification specification that minimises origin load, prevents unauthorized media consumption, and guarantees sub-50ms response times at scale.

Method

1. Define edge request interception flows on {{edge_provider}} before requests hit {{cms_origin_endpoint}}.
2. Formulate cryptographic validation logic for {{auth_token_format}} at the edge node, avoiding upstream authentication round-trips.
3. Establish edge response modification logic (Edge Side Includes or HTMLRewriter) to inject subscriber-only media blocks.
4. Design regional access filtering routines enforcing {{geo_restriction_rules}} with clear HTTP status mapping.
5. Map multi-tier caching directives across browser, edge POP, and origin shield based on {{cache_ttl_rules}}.
6. Architect stale-while-revalidate and cache invalidation webhook mechanisms for instant editorial updates.
7. Draft origin protection throttles, rate limits, and circuit breakers calibrated for {{traffic_peak_rps}}.

Constraints

• MUST execute all authentication verifications in under 10ms of edge CPU compute time.
• MUST NOT cache private user data or decrypted entitlement tokens in shared POP storage.
• Specify cache-tag headers for granular editorial purging.
• Include explicit handling of crawler/bot traffic for SEO indexing without exposing gated media.

Output format

Deliver an engineering specification divided into:

1. Edge Execution Flowchart (text/ASCII)
2. Token Cryptography & Verification Rules
3. Cache Strategy Matrix (Header, Public/Private, TTL, Invalidation Trigger)
4. Geo and DRM Gating Protocol
5. Origin Protection & Fail-Open/Fail-Closed Policies Length: 800-1300 words.

Self-review

• Verify all security steps account for {{auth_token_format}} tampering.
• Ensure TTL rules align with {{cache_ttl_rules}}.
• Validate that peak load mitigations address {{traffic_peak_rps}} without origin collapse.