Understanding Our Cache and the Web Cache Deception Attack

This post details the Web Cache Deception attack, explaining how misconfigurations in websites behind reverse proxies can lead to sensitive content being cached and exposed. It then describes Cloudflare's two-phase cache processing: eligibility (based on request characteristics like file extensions and cookie settings) and disqualification (based on response characteristics like Cache-Control and Expires headers, and Set-Cookie headers). It also lists specific file extensions that are always or sometimes cacheable.