We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result may show in a response to user B's request. Needless to say, this is a security bug, specifically, data from user A leaks to user B.

Although it is well-known that web application should be stateless, the long dependency graph of such application makes the likelihood of some downstream library (or its bad usage) accidentally leaking data between requests non-zero. I can imagine this bug is possible with a wide range of web frameworks and environments (e.g., Django, .NET, NodeJS, AWS Lambda), since they all reuse the application between request to avoid cold starts.


  1. What is the proper term for data leaking server-side between HTTP requests, due to an honest developer mistake? Terms such as session hijacking and session fixation seem to refer exclusively to malicious attacks.

  2. Are there tools and method to test for such mistakes or detect them in production?

  • Cache poisoning has a malicious ring to it, but sounds close. A unit test would catch that. Aug 7 '20 at 15:16
  • 1
    @postoronnim Not any unit test. It would have to be something like user A calls API X, user B calls API X right after. Also, given the large combinations of what could trigger such a leak (e.g., user B must call API X with srcImage==nil), I see a huge risk that even well-intended unit tests would not catch all potential leaks. Aug 7 '20 at 15:21
  • The steps you described can be coded up in a test. For a second opinion you can post this on QA Stack Exchange. Aug 7 '20 at 15:27
  • @postoronnim A specific way of triggering a leak, once found, could (and should) become a test, but I read "Are there tools and method to test for such mistakes or detect them in production" as asking for something more generic that tries to detect previously-unknown ways of triggering a leak... a sort of fuzzing program.
    – TripeHound
    Aug 7 '20 at 17:12
  • 1
    @user1202136 To be honest, I've no idea whether it is done or not at the moment (which is why it was only a comment, not an answer). If something does exist, it just feels like it might have similarities to fuzzing.
    – TripeHound
    Aug 8 '20 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.