It's pretty surprising to see an issue like this. I've spent some time in the past tuning http caches/cdns. One key takeaway I recall is the importance of your

It's pretty surprising to see an issue like this. I've spent some time in the past tuning http caches/cdns. One key takeaway I recall is the importance of your "cache key". That is, which fields matter when deciding if requests match. If the cache key of two requests match, the requests are considered identical and thus the desired behavior would be to serve from cache. Obviously, things like the request method, path and Host header matter a lot. Perhaps if you're A/B testing, the A/B cookie would make sense as part of the cache key too. This seems like a simple misconfiguration at a very critical location. But an 'exploit' that warrants it's own domain? Hardly. This is a promotion for the authors and their upcoming presentation. It's a very nice gotcha.