Lesson 2 · Free preview · 18 min

Path-confusion techniques

Delimiters, path normalisation, and extension mapping — the ways origin and cache disagree.

On this page

1. Path-parameter / delimiter confusion

The origin treats a character as a delimiter and ignores what follows; the cache treats it as part of the path (so it sees the .js ending):

/my-account;foo.js          ( ; is a matrix param to Java/Spring )
/my-account%3Bfoo.js
/my-account,foo.js
/my-account%00foo.js

Test each: does the origin still return your account page? Does the cache store it?

2. Path normalisation

Cache and origin disagree on .. and encoding:

/static/..%2fmy-account            -> cache: "/static/..." (cache it)
                                      origin: normalises to /my-account
/my-account%2f%2e%2e%2fstatic/x.js

3. Slash / encoded-slash confusion

/my-account%2f          ( origin: trailing slash ignored; cache: different key )

4. Extension-mapping confusion

Some frameworks map /profile.js to the profile handler and return JSON or HTML. The cache just sees .js.

/my-account.js

How to test methodically

  1. Baseline a real static file's caching headers (X-Cache, Age, CF-Cache-Status).
  2. For your account page, try each construct above.
  3. Success = your data in the body and a cache indicator, confirmed by a second cookie-less request returning the same data.