Collected research

Leaking secrets through caching with Bunny CDN

HTTP Toolkit and Tim Perry · HTTP Toolkit · 20 June 2023

Documents Bunny CDN caching authenticated responses without separating Authorization values, allowing one user's private response to be served to another. The article compares CDN handling strategies and gives a two-request test for detecting unsafe authenticated caching.

Record

Researcher

HTTP Toolkit and Tim Perry

Published by

HTTP Toolkit

Date

20 June 2023

In the archive

• Collected in the 2023 research round

Tags

• cache
• cdn
• auth-bypass
• info-leak
• http
• methodology
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of HTTP Toolkit and Tim Perry, first published at the original source. Preserved copies are kept so the citation survives its host.