Cache deception
Deception is a disagreement about what is safe to store. A second client must receive the private response before you call it cached.
Tags: cache, deception, cdn, session
Checklist
- Name the cache: Age, X-Cache, CF-Cache-Status, or the vendor header on the host you are testing. No header means you do not yet know it is cached.
- Cache key: Record whether path, query, cookie, and Authorization change the stored object. A private URL that ignores the session cookie is the lead.
- Static-looking path: Compare the private URL with the same path when the suffix looks like a static file. Different cache status on the same account data is the result.
- Normalization: Note whether the cache and the origin agree on case, extra segments, and encoded path characters. Disagreement is the note, not a wordlist.
- Second client: Load the URL in a clean session that never authenticated. Your own replay is not proof that someone else receives the body.
- What was stored: Use an account you own. Look for email, object ids, or tokens in the cached body. Stop if the body is not yours.
- Vary and Set-Cookie: A HIT that still carries a private Set-Cookie, or a missing Vary where the body depends on the viewer, is the result to record.
- Cleanup: Do not leave a private response in a shared cache. Purge, wait out the stated lifetime, or use a path that only your test user can request.