Unkeyed header / cache key
X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, Accept, Origin, cookie-less User-Agent, and unkeyed query params that the app uses to build links or JS.
Tags: cache, xss, cdn
Typical severity: P2-P4
What it becomes
If a header changes the response but is not in the cache key, you poison everyone who shares that key.
Where to look
CDN in front of a frameworkNext.js / Nuxt with Host-based URL generationstatic asset caches
Chains
- Stored XSS — Poison a cached HTML/JS page with a reflected header that writes a script src or a base href.
- Open redirect at scale — Poison Location or asset URLs so every cache hit leaves the site.
- Web cache deception — Path mapping like /account/settings/x.css so a personalised page is stored as a static asset.
Notes
- PortSwigger's cache-key gadgets (fat GET, unkeyed query, unkeyed header, unkeyed cookie) are the checklist.
- Always confirm the poisoned response is served to a second, clean client.