Cloudflare

Web Cache Deception Attack revisited

Jan 19, 2018Ka-Hing Cheung
Web Cache Deception Attack revisited
SummaryAI, from the source post

Introduced 'Cache Deception Armor' Page Rule to automatically prevent Web Cache Deception attacks by verifying URL extension against Content-Type. This feature protects against attacks where dynamic scripts are cached as static assets due to URL extensions. The rule prevents caching when a mismatch is detected, with exceptions for content types like application/octet-stream and common cross-format mappings (e.g., jpg to webp). The protection relies on Origin Cache Control or Edge Cache TTL Page Rules.

More from the Cache Management trail