3 ms·

Explain why security demands a separate cache?

• bawolff 2y ago
  Cache poisioning attacks.
  • paulddraper 2y ago
    Oh I see. Push was not limited to the same host. Which would have been an easy fix.
    • bawolff 2y ago
      Connections arent limited to the same (virtual) host. Additionally, to prevent cross page tracking, browsers use a separate cache for subresources loaded from different top level domains. Anyways, it is trickier than it sounds at first glance.
      • paulddraper 2y ago
        > Connections arent limited to the same (virtual) host. Huh? Doesn't HTTPS and SNI effectively require that?
        • bawolff 2y ago
          Its a minor point, since the rules are quite strict so its probably not a security issue, but no, due to connection coalescing, one connection can serve multiple virtual hosts. See https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/ https://daniel.haxx.se/blog/2016/08/18/http2-connection-coal...