Collected research

Reverse proxies & Inconsistency

Alexey Tiurin - Reverse proxies & Inconsistency

Aleksei "GreenDog" Tiurin · Speaker Deck · 23 January 2019

Reverse proxies, caches and load balancers decode and normalise URLs differently from the origin server, so path parameters, encoded dot-segments and double slashes make the two disagree about which path a request is for. The mismatch bypasses proxy access rules, misroutes requests, strips or adds security headers, and enables web cache deception and cache poisoning.

Record

Document

Alexey Tiurin - Reverse proxies & Inconsistency

Researcher

Aleksei "GreenDog" Tiurin

Published by

Speaker Deck

Date

23 January 2019

Format

Recording

Topic

Other

In the archive

• Collected in the 2019 research round

Related sources

• Reverse proxies & Inconsistency Slides

Tags

• parser-differential
• cache-deception
• cache-poisoning
• url-parsing
• reverse-proxy
• proxy
• auth-bypass
• cache
• http
• filter-bypass
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Aleksei "GreenDog" Tiurin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.