Glossary
Edge function
An edge function is code that runs on the content delivery network's own servers, close to the visitor, instead of at the origin. It sits in the request path: it can rewrite a request before it reaches the origin, modify a response on the way back, or answer entirely on its own without the origin being contacted. The practical consequence is that what a visitor receives may not be what the origin sent, which changes how every other observation about a site is read.
What it sits between
A static CDN rule matches and acts on fixed conditions — a path prefix, a header — and is fast and inflexible.
An origin server runs the application and has the full context, at the cost of a round trip to wherever it lives.
An edge function is neither: arbitrary code with a short execution budget, running at the edge node the visitor reached.
Its budget is what shapes what it can do. Tens of milliseconds of processor time is enough to rewrite a header or route a request, and not enough to render a complex page.
What it is typically used for
Adding or rewriting response headers, which is why a security header can be present in production and absent from the origin's own configuration.
Routing: sending a request to one of several origins based on geography, a cookie or an experiment assignment.
Authentication at the edge, so an unauthenticated request never reaches the application at all.
Personalising a cached response slightly, which lets a page stay cacheable while still varying per visitor in small ways.
Why it changes how a scan is read
A header observed in a response may have been added at the edge. The origin can be misconfigured and the misconfiguration invisible until traffic bypasses the edge.
A redirect may be performed at the edge, which makes it faster and also means the origin has no record of it.
A response may never have touched the origin, so origin-side logs do not show the request at all.
Which is why an external observation describes what reached the network, and why that is the honest thing for it to describe.
What is observable
The presence of an edge platform, detected from the headers a response carries.
Whether a CDN is in the path at all, and whether its cache is serving stored copies rather than forwarding every request.
The reverse proxy layer in front of the origin, and whether the origin address is exposed alongside it.
Not the function's code, and not what it does on requests the scan did not make — which includes most of the interesting cases.
The constraints that shape what it can do
A short processor budget per invocation, measured in tens of milliseconds rather than seconds.
A runtime that is usually not full Node.js, so libraries depending on filesystem or native modules do not run.
No local state between invocations, because the next request may reach a different node entirely.
Which is why the useful pattern is routing, rewriting and gating rather than rendering — anything that needs the database still belongs at the origin.
Frequently asked questions
- Is an edge function the same as a serverless function?
- Both run without a server you manage. An edge function runs at the CDN node with a very short budget; a serverless function runs in a region with a much longer one. The budget is the practical difference.
- Why does my security header appear in production but not in my server config?
- Very often because an edge function or a CDN rule adds it. That works for visitors and leaves the origin unprotected the moment anything reaches it directly.
- Can you tell me what my edge functions do?
- No. Only their effects on the responses received are visible. The code is not observable from outside and neither is its behaviour on requests nobody made.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website