HTTP Caching and Cache Poisoning

HTTP caching is a performance optimization technique that stores copies of resources to reduce server load, bandwidth usage, and latency. When implemented correctly, caching significantly improves web application performance, but when implemented incorrectly, it can lead to security vulnerabilities.

How HTTP Caching Works

View Larger

Types of HTTP Caches

• Browser Caches: Store resources locally on the user's device.
• Proxy Caches: Intermediate caches that serve multiple users.
• Gateway Caches: Server-side caches like reverse proxies and CDNs.
• Application Caches: Custom caching implemented within web applications.

HTTP Caching Headers

Cache Keys and Cache Operation

Web caches identify cached responses using a cache key, typically composed of:

• The request URL (usually the primary component)
• The HTTP method (GET, POST, etc.)
• Headers specified in the Vary header

When a request matches a cache key, the cached response is returned without contacting the origin server. This process is what makes cache poisoning attacks possible.

Cache Poisoning: The Basics

Cache poisoning occurs when an attacker manipulates a web cache to store and serve malicious content to users. The fundamental issue is that the cache key doesn't include all inputs that influence the response, creating a mismatch between what the cache considers "same" and what actually produces different responses.