AVOIDING SECURITY INCIDENTS DUE TO REQUEST COALESCING

Summary from the TLDR InfoSec newsletter

Web caching is often utilized to speed up costly calculations or decrease response times by maintaining a copy of data closer to users. Request coalescing is when Amazon CloudFront is used as a CDN and sees requests for the same cache key come in simultaneously and the CDN waits for the first response to be cached and then uses the cached copy for the following responses. Wiz found an unexpected behavior where Amazon CloudFront was ignoring the Cache-Control: no-cache header and sending sensitive cached content to users via request coalescing. To prevent this behavior, users must configure the managed cache policy CachingDisabled for those cache keys or set the minimum TTL for the cache behavior to 0 AND configure the origin to send the Cache-Control: no-cache header.