Cache Management
Web Cache Deception Attack revisited

Web Cache Deception Attack revisited

1/19/2018 · Ka-Hing Cheung

What this post added

Introduced 'Cache Deception Armor' Page Rule to protect against Web Cache Deception attacks. This feature verifies that the URL's extension matches the returned Content-Type, preventing caching of mismatched responses. It includes exceptions for content types like `application/octet-stream` and common image/video format substitutions. This protection depends on Origin Cache Control and can be overridden by origin `Cache-Control` headers or Edge Cache TTL Page Rules.

Read the original post ↗