Cache
Two clients. One poisons. The other must receive it.
Tags: cache, xss, cdn
Checklist
- Identify the cache — CF-Cache-Status, X-Cache, Age, Via, Akamai, Fastly, CloudFront, nginx proxy_cache.
- Key — What is in the key? Host, path, query, cookie, accept? Unkeyed header that changes the body is the bug.
- Fat GET / unkeyed query — Body on GET, extra query that the origin uses and the CDN ignores.
- Deception — Path /account plus static suffix, path normalization disagreements, encoded dots.
- Poison — Header, query, method. Confirm HIT on a second UA / IP.
- Do not persist junk — Use a harmless marker. Purge or wait if you poisoned a production cache.