Web Cache Deception and Cache Poisoning, Explained: When the Cache Reads a URL Differently
A cache that reads a URL differently from the application behind it can store a signed-in user's private page for anyone to fetch, or replay one attacker's header to every visitor. Here is how cache keys and path confusion cause both, and how to make the two layers agree.