Do not let an unkeyed request input alter Cloudflare-cacheable output

A response can be reused for clean requests when the input that changed it is absent from the key.

Source facts

Cloudflare describes cache poisoning as inducing a harmful response that shares a cache key with a clean request. Its guidance warns against reflecting untrusted header values into cached output when those values are not keyed. GET request bodies are not included in the cache key and should not change a cacheable response; bypassing cache or using POST may be appropriate when body-driven behavior is required.

Source: Cloudflare — Avoid Web Cache Poisoning.

Applicability

This is application and cache-design guidance, not a claim that Cloudflare automatically sanitizes all origin output or that a particular website has been compromised.

DSE recommendation

DSE recommends reviewing every input that changes a public cacheable response, including forwarded headers and unusual request bodies. Remove unnecessary reflection and keep user-specific output outside shared caching. If a meaningful response dimension must remain, use a supported key or bypass design and document why it is safe. Coordinate application and CDN changes rather than expecting one layer to compensate for undocumented behavior in the other. Have the application reviewer nominate inputs that should be irrelevant to public output, then use nonharmful markers to challenge that assumption in isolation. If an input changes content unexpectedly, return the finding to the application owner before approving any cache-key consolidation or wider public eligibility.

Verification

In an isolated security test, compare clean requests with controlled alternate headers or GET bodies using nonharmful markers. Confirm the altered input cannot contaminate a later clean response. Record the application response and cache key together, and avoid executing poisoning experiments against shared production content without explicit test authorization.

Official reference

Cloudflare — Avoid Web Cache Poisoning. Reviewed October 20, 2026.