Web cache deception

When it applies

A caching layer (CDN, reverse proxy) fronts an app that returns per-user content, and the cache decides what to store by URL pattern/extension. If you can make an authenticated response look cacheable, the cache stores it — and anyone can then fetch that victim's data.

Why it works

The cache and the origin disagree about the URL. The cache sees /account.css and thinks "static, cache it"; the origin ignores the .css suffix (or a delimiter) and serves the dynamic /account page. The victim's private response gets stored under a public key you can request.