{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
        "slug": "do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output",
        "url": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/"
        },
        "title": "Do not let an unkeyed request input alter Cloudflare-cacheable output",
        "summary": "A response can be reused for clean requests when the input that changed it is absent from the key.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:38+00:00",
        "modified_at": "2026-10-20T18:34:36+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 289,
        "potentially_affected": "This is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.",
        "dse_recommendation": "DSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies.",
        "primary_source": {
            "name": "Cloudflare — Avoid Web Cache Poisoning",
            "url": "https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/",
            "published_on": null,
            "authority": "developers.cloudflare.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A response can be reused for clean requests when the input that changed it is absent from the key.</p>\n<h2>Source facts</h2>\n<p>Cloudflare describes cache poisoning as inducing a harmful response that shares a cache key with a clean request. Its guidance warns against reflecting untrusted header values into cached output when those values are not keyed. GET request bodies are not included in the cache key and should not change a cacheable response; bypassing cache or using POST may be appropriate when body-driven behavior is required.</p>\n<p>Source: <a href=\"https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/\">Cloudflare — Avoid Web Cache Poisoning</a>.</p>\n<h2>Applicability</h2>\n<p>This is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies. Remove unnecessary reflection and keep user-specific output outside shared caching. If a meaningful response dimension must remain, use a supported key or bypass design and document why it is safe. Coordinate application and CDN changes rather than expecting one layer to compensate for undocumented behavior in the other. Have the application reviewer nominate inputs that should be irrelevant to public output, then use nonharmful markers to challenge that assumption in isolation. If an input changes content unexpectedly, return the finding to the application owner before approving any cache-key consolidation or wider public eligibility.</p>\n<h2>Verification</h2>\n<p>In an isolated security test, compare clean requests with controlled alternate headers or GET bodies using nonharmful markers. Confirm the altered input cannot contaminate a later clean response. Record the application response and cache key together, and avoid executing poisoning experiments against shared production content without explicit test authorization.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/\">Cloudflare — Avoid Web Cache Poisoning</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A response can be reused for clean requests when the input that changed it is absent from the key.\nSource facts\nCloudflare describes cache poisoning as inducing a harmful response that shares a cache key with a clean request. Its guidance warns against reflecting untrusted header values into cached output when those values are not keyed. GET request bodies are not included in the cache key and should not change a cacheable response; bypassing cache or using POST may be appropriate when body-driven behavior is required.\nSource: Cloudflare — Avoid Web Cache Poisoning.\nApplicability\nThis is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.\nDSE recommendation\nDSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies. Remove unnecessary reflection and keep user-specific output outside shared caching. If a meaningful response dimension must remain, use a supported key or bypass design and document why it is safe. Coordinate application and CDN changes rather than expecting one layer to compensate for undocumented behavior in the other. Have the application reviewer nominate inputs that should be irrelevant to public output, then use nonharmful markers to challenge that assumption in isolation. If an input changes content unexpectedly, return the finding to the application owner before approving any cache-key consolidation or wider public eligibility.\nVerification\nIn an isolated security test, compare clean requests with controlled alternate headers or GET bodies using nonharmful markers. Confirm the altered input cannot contaminate a later clean response. Record the application response and cache key together, and avoid executing poisoning experiments against shared production content without explicit test authorization.\nOfficial reference\nCloudflare — Avoid Web Cache Poisoning. Reviewed October 20, 2026.",
        "content_markdown": "A response can be reused for clean requests when the input that changed it is absent from the key.\n\n## Source facts\n\nCloudflare describes cache poisoning as inducing a harmful response that shares a cache key with a clean request. Its guidance warns against reflecting untrusted header values into cached output when those values are not keyed. GET request bodies are not included in the cache key and should not change a cacheable response; bypassing cache or using POST may be appropriate when body-driven behavior is required.\n\nSource: [Cloudflare — Avoid Web Cache Poisoning](https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/).\n\n## Applicability\n\nThis is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.\n\n## DSE recommendation\n\nDSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies. Remove unnecessary reflection and keep user-specific output outside shared caching. If a meaningful response dimension must remain, use a supported key or bypass design and document why it is safe. Coordinate application and CDN changes rather than expecting one layer to compensate for undocumented behavior in the other. Have the application reviewer nominate inputs that should be irrelevant to public output, then use nonharmful markers to challenge that assumption in isolation. If an input changes content unexpectedly, return the finding to the application owner before approving any cache-key consolidation or wider public eligibility.\n\n## Verification\n\nIn an isolated security test, compare clean requests with controlled alternate headers or GET bodies using nonharmful markers. Confirm the altered input cannot contaminate a later clean response. Record the application response and cache key together, and avoid executing poisoning experiments against shared production content without explicit test authorization.\n\n## Official reference\n\n[Cloudflare — Avoid Web Cache Poisoning](https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
                "url": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Do not let an unkeyed request input alter Cloudflare-cacheable output",
                        "item": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/#article",
                "identifier": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
                "url": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/",
                "headline": "Do not let an unkeyed request input alter Cloudflare-cacheable output",
                "description": "A response can be reused for clean requests when the input that changed it is absent from the key.",
                "abstract": "A response can be reused for clean requests when the input that changed it is absent from the key.",
                "articleBody": "A response can be reused for clean requests when the input that changed it is absent from the key.\nSource facts\nCloudflare describes cache poisoning as inducing a harmful response that shares a cache key with a clean request. Its guidance warns against reflecting untrusted header values into cached output when those values are not keyed. GET request bodies are not included in the cache key and should not change a cacheable response; bypassing cache or using POST may be appropriate when body-driven behavior is required.\nSource: Cloudflare — Avoid Web Cache Poisoning.\nApplicability\nThis is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.\nDSE recommendation\nDSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies. Remove unnecessary reflection and keep user-specific output outside shared caching. If a meaningful response dimension must remain, use a supported key or bypass design and document why it is safe. Coordinate application and CDN changes rather than expecting one layer to compensate for undocumented behavior in the other. Have the application reviewer nominate inputs that should be irrelevant to public output, then use nonharmful markers to challenge that assumption in isolation. If an input changes content unexpectedly, return the finding to the application owner before approving any cache-key consolidation or wider public eligibility.\nVerification\nIn an isolated security test, compare clean requests with controlled alternate headers or GET bodies using nonharmful markers. Confirm the altered input cannot contaminate a later clean response. Record the application response and cache key together, and avoid executing poisoning experiments against shared production content without explicit test authorization.\nOfficial reference\nCloudflare — Avoid Web Cache Poisoning. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:38+00:00",
                "dateModified": "2026-10-20T18:34:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/do-not-let-an-unkeyed-request-input-alter-cloudflare-cacheable-output/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Do not let an unkeyed request input alter Cloudflare-cacheable output"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 289,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Cloudflare — Avoid Web Cache Poisoning",
                    "url": "https://developers.cloudflare.com/cache/cache-security/avoid-web-poisoning/"
                }
            }
        ]
    }
}