Lesson 2
· Free preview · 18 min
Path-confusion techniques
Delimiters, path normalisation, and extension mapping — the ways origin and cache disagree.
1. Path-parameter / delimiter confusion
The origin treats a character as a delimiter and ignores what follows; the
cache treats it as part of the path (so it sees the .js ending):
/my-account;foo.js ( ; is a matrix param to Java/Spring )
/my-account%3Bfoo.js
/my-account,foo.js
/my-account%00foo.js
Test each: does the origin still return your account page? Does the cache store it?
2. Path normalisation
Cache and origin disagree on .. and encoding:
/static/..%2fmy-account -> cache: "/static/..." (cache it)
origin: normalises to /my-account
/my-account%2f%2e%2e%2fstatic/x.js
3. Slash / encoded-slash confusion
/my-account%2f ( origin: trailing slash ignored; cache: different key )
4. Extension-mapping confusion
Some frameworks map /profile.js to the profile handler and return JSON or
HTML. The cache just sees .js.
/my-account.js
How to test methodically
- Baseline a real static file's caching headers (
X-Cache,Age,CF-Cache-Status). - For your account page, try each construct above.
- Success = your data in the body and a cache indicator, confirmed by a second cookie-less request returning the same data.