{"id":"https://openalex.org/W7146968037","doi":"https://doi.org/10.15168/11572_478270","title":"Security Implications of Web Caching","display_name":"Security Implications of Web Caching","publication_year":2026,"publication_date":"2026-03-10","ids":{"openalex":"https://openalex.org/W7146968037","doi":"https://doi.org/10.15168/11572_478270"},"language":"en","primary_location":{"id":"pmh:doi:10.15168/11572_478270","doi":null,"is_oa":false,"landing_page_url":"https://hdl.handle.net/11572/478270","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Other"},"volume":null,"type":"other","is_traditional":false,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hdl.handle.net/11572/478270","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092885738","display_name":"Matteo Golinelli","orcid":"https://orcid.org/0000-0002-8743-0825","observed_orcids":["https://orcid.org/0000-0002-8743-0825"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Golinelli, Matteo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5092885738"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/web-caching","display_name":"web caching","score":0.8140000104904175},{"id":"https://openalex.org/keywords/cache-poisoning","display_name":"cache poisoning","score":0.8759999871253967},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.9290000200271606},{"id":"https://openalex.org/keywords/data-leakage","display_name":"data leakage","score":0.7129999995231628},{"id":"https://openalex.org/keywords/supply-chain-compromise","display_name":"supply chain compromise","score":0.9020000100135803},{"id":"https://openalex.org/keywords/timing-analysis","display_name":"timing analysis","score":0.5609999895095825}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8176000118255615},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.7095999717712402},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4779999852180481},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.45320001244544983},{"id":"https://openalex.org/C38556500","wikidata":"https://www.wikidata.org/wiki/Q13404475","display_name":"Cache algorithms","level":4,"score":0.45260000228881836},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.40689998865127563},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.38029998540878296},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31869998574256897},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.31360000371932983},{"id":"https://openalex.org/C113166858","wikidata":"https://www.wikidata.org/wiki/Q5015981","display_name":"Cache pollution","level":5,"score":0.30410000681877136},{"id":"https://openalex.org/C25536678","wikidata":"https://www.wikidata.org/wiki/Q5015977","display_name":"Cache invalidation","level":5,"score":0.29010000824928284},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.28360000252723694},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2563999891281128}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:doi:10.15168/11572_478270","doi":null,"is_oa":false,"landing_page_url":"https://hdl.handle.net/11572/478270","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Other"},{"id":"pmh:oai:iris.unitn.it:11572/478270","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/11572/478270","pdf_url":null,"source":{"id":"https://openalex.org/S4306401913","display_name":"Institutional Research Information System (Universit\u00e0 degli Studi di Trento)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I193223587","host_organization_name":"University of Trento","host_organization_lineage":["https://openalex.org/I193223587"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/doctoralThesis"},{"id":"doi:10.15168/11572_478270","doi":"https://doi.org/10.15168/11572_478270","is_oa":true,"landing_page_url":"https://doi.org/10.15168/11572_478270","pdf_url":null,"source":{"id":"https://openalex.org/S7407051007","display_name":"Universit\u00e0 degli Studi di Trento","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Other"}],"best_oa_location":{"id":"pmh:oai:iris.unitn.it:11572/478270","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/11572/478270","pdf_url":null,"source":{"id":"https://openalex.org/S4306401913","display_name":"Institutional Research Information System (Universit\u00e0 degli Studi di Trento)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I193223587","host_organization_name":"University of Trento","host_organization_lineage":["https://openalex.org/I193223587"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/doctoralThesis"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7096988810","https://openalex.org/W6932002625","https://openalex.org/W7100732193","https://openalex.org/W2336508927","https://openalex.org/W2559104460","https://openalex.org/W2507769312","https://openalex.org/W2895212262","https://openalex.org/W6885169400","https://openalex.org/W2807036472","https://openalex.org/W2924333397"],"abstract_inverted_index":{"The":[0],"World":[1],"Wide":[2],"Web":[3,81,171],"relies":[4],"heavily":[5],"on":[6,69,90],"caching":[7,156,275],"to":[8,50,108,142,184,208,257],"improve":[9],"performance":[10,187],"and":[11,40,59,66,85,114,150,154,188,211,213,246,261,276,283],"scalability,":[12],"yet":[13],"the":[14,26,104,125,163,230,233,247,267],"security":[15,27,127,158,164,238,271],"aspects":[16],"of":[17,29,42,129,157,165,191,200,232,249],"this":[18,70,194,222],"mechanism":[19],"remain":[20],"poorly":[21],"understood.":[22],"This":[23],"thesis":[24],"investigates":[25],"posture":[28],"web":[30,36,52,140,166,201,236,274],"caches":[31,53],"following":[32],"three":[33],"incremental":[34],"steps:":[35],"cache":[37,86,130,182,186,202,237],"detection,":[38],"exploitation,":[39],"uncovering":[41],"novel":[43],"attack":[44,145,177,251],"primitives.":[45],"First,":[46],"we":[47,72,169,228],"introduce":[48,170],"methodologies":[49],"detect":[51],"using":[54],"response":[55],"headers,":[56],"timing":[57],"analysis,":[58,245],"subtle":[60],"header":[61],"variations,":[62],"comparing":[63],"their":[64],"effectiveness":[65],"limitations.":[67],"Building":[68],"foundation,":[71],"present":[73],"large-scale":[74,209,243],"techniques":[75],"for":[76,93,218,269,280],"detecting":[77],"vulnerabilities":[78,92,141],"such":[79],"as":[80,215],"Cache":[82,172],"Deception":[83],"(WCD)":[84],"poisoning.":[87],"We":[88,122],"focus":[89],"understudied":[91],"which":[94],"no":[95],"automated":[96],"detection":[97,206,241],"tools":[98,256],"exist.":[99],"Our":[100,264],"empirical":[101],"analysis":[102],"includes":[103],"largest":[105],"WCD":[106,134],"study":[107],"date,":[109],"identifying":[110],"1,188":[111],"vulnerable":[112],"domains":[113],"challenging":[115],"prior":[116],"assumptions":[117],"about":[118],"its":[119],"real-world":[120],"severity.":[121],"then":[123],"explore":[124],"broader":[126],"implications":[128],"misuse,":[131],"showing":[132],"how":[133,155],"can":[135,160],"be":[136],"chained":[137],"with":[138],"other":[139],"create":[143],"complex":[144],"vectors":[146],"enabling":[147],"data":[148],"leakage":[149],"supply":[151],"chain":[152],"compromise,":[153],"tokens":[159],"severely":[161],"impact":[162],"users.":[167],"Finally,":[168],"Overflow":[173],"(WCO),":[174],"a":[175,197,216],"new":[176,250],"primitive":[178],"that":[179],"exploits":[180],"imprecise":[181],"keying":[183],"degrade":[185],"cause":[189],"Denial":[190],"Service.":[192],"Overall,":[193],"work":[195],"provides":[196],"comprehensive":[198],"exploration":[199],"vulnerabilities,":[203],"from":[204],"foundational":[205],"challenges":[207],"exploitation":[210],"mitigation,":[212],"serves":[214],"basis":[217],"further":[219,259],"research":[220,260],"in":[221,235,273],"critical":[223],"area.":[224],"Through":[225],"these":[226],"contributions,":[227],"advance":[229],"state":[231],"art":[234],"through":[239],"systematic":[240],"methodologies,":[242],"vulnerability":[244],"discovery":[248],"vectors,":[252],"accompanied":[253],"by":[254],"open-source":[255],"foster":[258],"defensive":[262],"development.":[263],"findings":[265],"underscore":[266],"need":[268],"improved":[270],"practices":[272],"provide":[277],"actionable":[278],"insights":[279],"both":[281],"researchers":[282],"practitioners.":[284]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-04-02T00:00:00"}