We moved private course videos behind CloudFront signed cookies. The app set the three cookies, yet the browser got 403 Missing Key-Pair-Id for every segment: cookies were scoped to the app's host, not the CDN's, and the behaviour trusted a different key group. How we debugged it with curl.
After a framework upgrade, our CDN cache hit ratio for static assets dropped from 97 to 41 percent and origin data transfer doubled. The new session middleware attached Set-Cookie and Cache-Control private to every response, including JavaScript bundles. Scoping middleware fixed it.
An overview of Cloudflare's Free, Pro, Business and Enterprise plans, then a practical guide to everything the free tier offers a small team: DNS, CDN, Universal SSL, DDoS protection, WAF managed rules, rate limiting, Tunnel, Zero Trust, Pages, Workers, R2 and Turnstile, with a setup order.