What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Web cache poisoning happens when an input changes the response generated by a website, but the cache does not include that input in its cache key. If the changed response is cacheable, it can be stored under a key shared with ordinary requests and served to other visitors. The risk depends on what the response does and which requests share that cache entry—not every finding affects every visitor.
How does web cache poisoning work?
A cache uses a cache key—a selected set of request properties—to decide whether a stored response can be reused. Requests with the same key are treated as equivalent for that lookup. Other request details are unkeyed inputs: the cache does not use them to distinguish one request from another.
As an Amazon Associate I earn from qualifying purchases.
A vulnerability can arise when the origin server uses an unkeyed input to create its response, while the cache ignores that input. The origin then treats two requests differently even though the cache treats them as the same. If the altered response is cacheable, the cache may store it for subsequent requests using the same key. Cloudflare’s documentation describes the attack as using an HTTP request to make an origin return a harmful resource with the same cache key as a clean request (Cloudflare documentation, updated May 6, 2026).
Recommended Free Tools
A hypothetical example
Suppose a site uses an untrusted forwarding header to create an absolute link in an HTML page, but its CDN does not include that header in the cache key. A crafted header value could alter the generated page. If the response is cached under the same key as the clean request, later visitors whose requests use that key could receive the altered page. This illustrates the mechanism; the outcome depends on the site’s actual response and cache configuration.
#1 Best Overall
What can a poisoned response do?
Possible consequences include cross-site scripting, redirects, or substitution of page content. The exact impact depends on what the changed response contains and how browsers and the application handle it; a cache-poisoning condition does not by itself establish that any particular consequence is achievable.
Reach depends on the cache layer and key involved, whether the response is eligible for caching, how long it remains stored, and whether key dimensions such as the HTTP Vary response header separate requests. A shared cache may serve an affected response to more than the request that first caused it, until the entry expires or is purged.
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
How is cache poisoning different from cache deception?
Cache poisoning makes the origin produce a harmful response by manipulating an input the cache does not key on; that response is then stored under a key that clean requests also use. Web cache deception instead tricks a cache into storing private or personalized content at a URL the cache treats as static-looking or otherwise cacheable. Both exploit differences in cache and origin behavior, but their mechanisms are distinct.
How can defenders test for it safely?
The key question is whether an input can change a response without changing the cache key—and whether the changed response can be cached. PortSwigger’s guidance describes identifying unkeyed inputs, checking what response change they enable, and then assessing cacheability. Its practical research describes Param Miner, an open-source Burp Suite extension, as a tool that can help identify candidate unkeyed inputs. A cache-buster can help distinguish a fresh origin response from one already served by a cache.
Rank #3
- Get authorization and agree on scope. Test only systems you are authorized to assess. Coordinate with the system owner before testing a shared live cache.
- Identify candidate inputs and response changes. Use an approved test environment or coordinated testing process to determine whether a request detail changes the origin’s response.
- Check cache behavior through the full path. Use cache-busting where appropriate to distinguish fresh responses from stored ones, and verify behavior across the CDN, proxy, and origin involved.
- Plan cleanup before testing. Agree on how to remove any test entry and confirm that cleanup reaches every affected cache layer. Avoid harmful payloads on shared live caches because successful tests may affect other visitors.
PortSwigger’s methodology is described in its Web Security Academy guidance and practical web cache poisoning research. These explain testing concepts; platform-specific behavior should be checked against the relevant provider’s current documentation.
How can teams prevent poisoning?
Mitigations depend on whether an input is necessary, whether it can safely be included in the key, and whether the response should be shared-cacheable at all. More key variation can reduce cache reuse, while rejecting unnecessary inputs or avoiding shared caching on sensitive routes can prevent those inputs from influencing shared entries. The right choice depends on the application and its cache path.
- Align response behavior with the key. Ensure every request input that can change a cacheable response is represented in the cache key, or reject that input for the route.
- Limit shared caching to suitable content. Cache only routes and representations intended to be shared. Do not let unkeyed headers or a GET request body alter a cacheable response.
- Handle forwarding headers and URL construction carefully. Trust forwarding headers only when a trusted proxy sets or replaces them. Canonicalize the host and scheme before using them to create links or redirects.
- Keep parsing consistent across layers. Make URL normalization, query handling, and routing consistent across CDN, proxy, and origin. Reject ambiguous inputs rather than allowing different layers to interpret them differently.
- Protect sensitive or personalized responses. Set explicit cache policies and avoid shared caching when authorization or personalization changes the representation. OWASP cautions that
Vary: Cookieshould not be treated as a general authorization boundary (OWASP Cache Control Cheat Sheet).
What should teams do after an incident?
- Purge affected cache layers so the known poisoned entries are removed.
- Fix the mismatch between inputs that influence the response and the cache key—or reject the input or disable shared caching for the affected route.
- Verify the corrected behavior across the complete CDN, proxy, and origin path before restoring caching.
A purge removes entries; it does not correct the underlying behavior that allowed them to be stored.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
