Web cache poisoning & deception

When it applies

A shared cache (CDN/reverse proxy) sits in front of the app. Poisoning: an unkeyed input influences the response but isn't part of the cache key, so your malicious response gets stored and served to everyone. Deception: the cache is tricked into storing a victim's private page.

Why it works

Caches key on some request parts (URL, maybe some headers) and ignore others ("unkeyed"). If an unkeyed header/param changes the response (reflected X-Forwarded-Host, a header-driven script src), you poison the cached copy. Deception exploits path/extension rules that cache things that shouldn't be cached.