{"content":"

Dynamic Asset Loading

Banner Key: Welcome to the shared cache demo

Active Asset URL: https://cdn.vulnerableapp.local/assets/cache-poisoning-demo.js

Security Monitor: Context Loading

The browser is attempting to load the resource from the host above. Use the Network Tab to verify the origin.

The banner is now part of the cache key, but the application trusts the X-Forwarded-Host header for asset URLs.

If the cache ignores this header, the asset location can be poisoned.

","isValid":true}