Reading cache headers

4 min read

Caches announce themselves, and learning to read them is most of the skill.

• X-Cache: HIT / MISS (or cf-cache-status, X-Cache-Hits) — did this come from the cache or the origin? A HIT means someone before you requested it; it is the side channel and the confirmation your poison stuck.
• Age: — seconds the response has sat in the cache. Non-zero means cached.
• Cache-Control / Expires — the origin's caching instructions. Note when a private page carries a permissive one by accident.
• Vary: — headers the cache adds to the key. If User-Agent is not in Vary but the origin reflects it, that is an unkeyed input.

The workflow: send a request, note whether the reflected input landed in the response, then resend a clean request to the same URL and check X-Cache. If the clean request comes back with your payload and a HIT, you poisoned a shared cache entry.