Cache Deception

Definition

Attacker tricks cache to store private content at public URL.

Root cause

Path confusion + cache rules.

Affected components

• Components in the “Logic” class
• Application / API handlers
• Supporting libraries

Impact

Private data served to others.

Severity

Medium · CVSS 6.5

Safe lab reproduction

Cache deception labs

Detection methodology

Cache behavior testing.

Evidence examples

• Lab reproduction notes: Cache deception labs
• Request/response excerpts (redacted)
• Detection signal: Cache behavior testing

Remediation

Never cache authenticated responses on shared URLs.

Secure coding examples

Cache-Control: private on sensitive routes.