🧊🎯🔓💥 Web Cache Deception: How a Harmless .css Becomes Full Account Takeover

A CDN and your app can read the exact same URL two different ways. That tiny disagreement is enough to hand one user's session token to a complete stranger.

TL;DR: Web Cache Deception (WCD) tricks a shared cache into storing a victim's private, authenticated response under a URL that looks static. You append something like /wcd.css to a sensitive endpoint, get the victim to open it, and the CDN happily caches their response — token, PII and all — in a public cache. Then you request the same URL from your own browser and read their secrets back. No XSS, no CSRF, no malware. Just two parsers that disagree about what a URL is. This is the single best example I know of why detection is not proof: a scanner can tell you a response "looks cacheable," but only a re-exploit proves a stranger's session actually landed in the cache.

🎯 The one-sentence version

The origin server and the cache in front of it parse the same path differently. The origin sees a dynamic, authenticated page. The cache sees a boring static file and stores it where everyone can reach it. You live in that gap.

Omer Gil introduced this class at Black Hat USA 2017 ("Web Cache Deception Attack") with the now-classic trick of appending a non-existent static…