Web Cache Deception Attack revisited
Jan 19, 2018Ka-Hing Cheung

Summary
Introduced 'Cache Deception Armor' Page Rule to automatically prevent Web Cache Deception attacks by verifying URL extension against Content-Type. This feature protects against attacks where dynamic scripts are cached as static assets due to URL extensions. The rule prevents caching when a mismatch is detected, with exceptions for content types like application/octet-stream and common cross-format mappings (e.g., jpg to webp). The protection relies on Origin Cache Control or Edge Cache TTL Page Rules.