'.\n3. The HTTP cache saves this response under cache key 'GET /'.\n4. All subsequent visitors fetching '/' receive the poisoned page containing the attacker's script!\n\nKey Takeaway: Disable un-keyed header overrides or include custom headers in CDN cache keys to prevent Web Cache Poisoning."}},{"@type":"Question","name":"How do Time-of-Check to Time-of-Use (TOCTOU) Race Conditions cause double-spending in financial APIs?","acceptedAnswer":{"@type":"Answer","text":"**Time-of-Check to Time-of-Use (TOCTOU)** race conditions occur when an application checks a condition (user balance $\\ge \\$100$) and performs an action (deduct $\\text{balance}$) in non-atomic steps:\n\n### Double-Spend Exploit:\nAn attacker fires 10 concurrent requests simultaneously ('Promise.all([transfer(), transfer(), ...])').\n- All 10 requests pass the balance check BEFORE any single request completes the deduction!\n- **Fix**: Use atomic database transactions with **'SELECT ... FOR UPDATE'** row locking or atomic update operations ('UPDATE account SET balance = balance - 100 WHERE balance >= 100').\n\nKey Takeaway: Use atomic database transactions with row locking or conditional UPDATE queries to prevent TOCTOU double-spending race conditions."}},{"@type":"Question","name":"What is the Permissions-Policy (formerly Feature-Policy) HTTP header?","acceptedAnswer":{"@type":"Answer","text":"The **'Permissions-Policy'** (formerly Feature-Policy) HTTP header allows web applications to explicitly restrict which browser hardware APIs and features can be used by the page or embedded '