Check Cloudflare Cache Deception Armor against application fallback routes

A static-looking suffix can hide a personalized dynamic response when the origin accepts extra path segments.

Source facts

Cloudflare describes cache deception where a path ending like a static file returns the same personalized response as its parent route. Cache Deception Armor compares the URL extension with returned Content-Type and can decline caching on dangerous mismatches. The source documents exceptions and warns that origin cache directives or an Edge Cache TTL rule can override the protection.

Source: Cloudflare — Cache Deception Armor.

Applicability

This concerns the documented Cloudflare feature and origin routing behavior.

DSE recommendation

DSE recommends testing authenticated routes that accept arbitrary trailing segments before introducing broad static caching. Keep personalized responses explicitly outside shared cache and reject unsupported path shapes in the application where practical. Review the effective cache rule and origin headers together, including overrides that could defeat the feature. Document legitimate extension/type exceptions rather than disabling the protection globally when one asset format differs. Keep the original authenticated route, appended suffix, returned type, and applicable override on one test record. Add a legitimate transformed image as a control. Require both application and CDN owners to accept the exception set instead of judging the feature by one blocked example.

Verification

Use a controlled nonproduction account and harmless marker to compare the normal route with an appended static-looking suffix. Verify that user-specific content is not shared with another session. Inspect Content-Type and effective cache behavior, then repeat after any edge TTL change that could alter the protection’s outcome.

Official reference

Cloudflare — Cache Deception Armor. Reviewed October 20, 2026.