How Cloudflare protects customers from cache poisoning

This post details how Cloudflare protects customers from cache poisoning attacks by modifying its cache key strategy. Previously, cache keys primarily consisted of URL components. The vulnerability exploited origins reflecting data from HTTP headers not included in the cache key, allowing attackers to inject arbitrary data (e.g., JavaScript) into cached responses. Cloudflare's mitigation involves updating the cache key to include specific 'interesting' headers (X-Forwarded-Host, X-Host, X-Forwarded-Scheme) when their values differ from the Host or URL, thereby preventing the caching of poisoned responses. The post also mentions proactive customer notification and blocking of obviously malicious content via WAF.