Agent-ready workflow · request
Cache, Proxy, and Origin Boundary
Compare how client, CDN, proxy, cache, and origin normalize a request without affecting other users.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- cache hit
- vary mismatch
- unkeyed input
- proxy rewrite
- ambiguous request
Prerequisites
- unique cache keys
- controlled path or record
- low request cap
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Map the request hops
Record client, CDN, proxy, cache, load balancer, framework, and origin evidence.
Inputs
- controlled URL
Outputs
- hop map
- baseline headers
- Evidence gate
- Cache status, age, vary, and origin indicators are captured.
- Negative control
- A unique uncacheable control bypasses shared state.
- Stop condition
- Do not test shared popular pages.
Map key and normalization inputs
Change one header, query, path, encoding, method, or body property at a time.
Inputs
- fresh unique key per attempt
Outputs
- interpretation matrix
- Evidence gate
- The responsible unkeyed or differently parsed input is isolated.
- Negative control
- A new cache buster and clean request restore baseline.
- Stop condition
- Stop if another user could receive the test response.
Prove a controlled effect
Demonstrate only against a test path, account, or unique key you can re-prime and clear.
Inputs
- supported boundary mismatch
Outputs
- paired cache evidence
- Evidence gate
- The effect survives a fresh client request to the same controlled key.
- Negative control
- A distinct key stays unaffected.
- Stop condition
- No poisoning of shared content or availability tests.
Eliminate cache confounders
Check browser cache, CDN variation, regional edges, stale responses, retries, and origin personalization.
Inputs
- paired evidence
Outputs
- confounder log
- minimal report
- Evidence gate
- The claimed hop is supported by repeatable headers and key behavior.
- Negative control
- Clean requests from the same environment behave consistently.
- Stop condition
- Purge only when authorized; otherwise allow the controlled key to expire and record that cleanup limitation.
Related methods
Continue with the right depth.
Sources