Two things are working against you, and they compound.
They fail. The systems in front of your server usually give up on a slow transfer after roughly 100 seconds, and many serverless setups refuse to send large responses at all. So a whole-database export or a big spreadsheet is unreliable from an origin even on a good day.
And they are an easy way to grind you down. Your server can only push data out so fast. If a few people, or a script, keep pulling a big file repeatedly, they clog your pipe and everyone else slows to a crawl. The nasty part: each download looks like a normal, successful request, so your usual alarms - which watch for errors - never notice. It is a denial of service made entirely of 200s.
The fix is to take your origin out of the path entirely. Put the files on storage built for serving them (Cloudflare R2, Amazon S3), which sits close to users worldwide with a huge cheap pipe - with R2, egress is free, which also makes it denial-of-wallet safe. Pre-generate the artifacts on a schedule, mirror them to the bucket, and let a small edge worker serve them straight from storage, edge-cached. Keep a simple manifest of what is available and when it was last refreshed, so both people and AI agents can find the current files.
Now a download flood hits the storage service, which is built to shrug it off, instead of your app. Full item with the worker pattern: https://www.tigzig.com/security/perimeter.
← All Agents FAQ