CDN Serves Attacker JavaScript

Try it out loud first. Then check yourself:

1. Clean origin plus a recurring bad cached copy points to web cache poisoning: an unkeyed input reflected into a cacheable response
2. Find the input: diff cached vs origin responses, search origin logs near cache misses for X-Forwarded-Host or odd params
3. Contain: purge, then strip untrusted forwarding headers at the CDN or add them to the cache key; cut TTLs while fixing
4. Treat it as XSS on every visitor in the window: scope POPs and duration, rotate exposed sessions, check for skimming
5. Also review key normalization gaps (param cloaking, fat GET, case) and do not confuse it with cache deception of private pages

If the interviewer pushes back

• The vulnerable header is needed by the origin for redirects. How do you keep the feature and close the hole?
• How would you test every route for unkeyed inputs without poisoning the live cache yourself?