thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Web Cache Poisoning

Causing a cache to store a malicious response that is then served to other users.

Definition

Attackers manipulate unkeyed inputs (headers not included in the cache key, such as X-Forwarded-Host) that influence the response. Mitigations include caching only static content, including relevant headers in cache keys, ignoring unkeyed headers in the application and disabling unused header support.

Example

An unkeyed X-Forwarded-Host header changes a script URL in a cached page served to all users.

Exam tip

Look for 'unkeyed input' in cache questions.

Related terms