The awkward middle
That shared and personal split leaves an awkward middle: responses that are almost shared, differing only by a header tweak, a test bucket, or an auth check.
Count what round-tripping to your origin for a two-line decision costs. Two hundred milliseconds, to compute nothing.
Close the gap by running your code inside the location itself. Your function intercepts the request before the cache and can rewrite it, choose a response, or edit what goes back out.
Understand why these platforms look the way they do. A cold start has to be invisible at the edge, so one provider runs your code as lightweight isolates starting in under a millisecond, rather than containers taking hundreds.
Respect the constraints, which are real. Tight processor budgets per request, capped memory, no local disk. This is a place for decisions, not computation.
Put the right work there. Validating auth tokens, so bad ones bounce at the edge without touching your origin. Assigning test buckets, where the function hashes somebody and rewrites the request to fetch the right cached variant, keeping both variants cacheable.
Add routing and blocking by country, using what the location already knows, and any redirect or header change that would otherwise pay a full origin round trip.
State is the boundary
Respect state as the boundary. Your location holds your code and not your database, so any lookup either travels to a central store, giving back the latency you saved, or uses the edge-replicated storage.
Storage honestly: eventually consistent, with writes taking up to a minute to reach every location. Excellent for feature flags and redirect maps, wrong for a shopping cart.
Apply the same discipline as all caching. Decide which data tolerates being stale everywhere for seconds or minutes, push that to the edge, and keep everything else behind a single source of truth.
Worked example
Marta's streaming service gates video manifests by subscription tier, and the check used to hit origin: 180 ms from Sao Paulo, on every playlist refresh, every few seconds during playback. She moves it into a Cloudflare Worker. The JWT in each request already encodes the tier and expiry, so the worker verifies the signature with a public key stored in Workers KV, checks the tier claim, and either serves the manifest from the edge cache or returns a 403, all inside the PoP. Origin sees only token refreshes, about 2 percent of previous traffic on that path. Manifest latency in Brazil falls from 180 ms to 9 ms, and rebuffering complaints drop measurably. Key rotation is the one piece of ceremony: new public keys go into KV a day before use, since KV propagation is eventually consistent.