zakirkun Web Cache Deception
Overview
Web cache deception exploits a discrepancy between how the server and cache interpret URL paths. An attacker tricks a victim into visiting https://example.com/profile/nonexistent.css — the server ignores the .css extension and serves the authenticated profile page, but the CDN caches it as a public CSS file. The attacker then retrieves the cached authenticated response.
Remediation
- Cache responses based on their Content-Type, not URL extension
- Never cache authenticated API responses
- Set
Cache-Control: no-storefor all authenticated/personalized content