Question 1

What is web cache deception?

Accepted Answer

Web cache deception tricks a caching layer (a CDN or reverse proxy) into storing a victim's private, personalised response under a URL that looks like a static asset. The attacker sends the victim a link such as /account/profile.css; the CDN caches by extension, and the origin ignores the suffix and returns the private page — which the attacker can then fetch from the cache without authentication.

Question 2

How is it different from cache poisoning?

Accepted Answer

Cache poisoning injects a malicious response that gets served to many victims. Web cache deception is the reverse: it caches a real victim's private response and lets the attacker read it. The root causes differ — deception is a mismatch between how the cache keys/caches a URL and how the origin routes it.

Question 3

How do I prevent web cache deception?

Accepted Answer

Cache based on the response Content-Type, not the URL extension, so a text/html page is never cached as a .css asset. Mark authenticated, user-specific responses Cache-Control: no-store (and have the CDN honour origin headers), and route strictly at the origin so /account/profile.css returns 404 instead of the profile.

Web Cache Deception

Challenges

Frequently Asked Questions