Agar CDN/proxy javobni kalitga bog'lab saqlasa va kalitda foydalanuvchi kiritgan qiymat bo'lsa — hujumchi birinchi so'rovni zaharlab, keyingi minglab foydalanuvchiga o'z kontentini ko'rsatadi.

// Kalit butun URL bo'lsa
key = "GET /product?id=1"        // id o'zgarsa — alohida kalit. Xavfsizroq

// Kalit faqat domen bo'lsa — XAVFLI
key = "GET https://site.uz/"     // ?id=1 yoki ?id=2 → bir xil kalit

// Hujum:
1. GET /?id=1</script><script>alert(1)</script>   ← zaharlash
2. CDN uni kalitga saqlaydi
3. Boshqa foydalanuvchi /?id=1 so'raydi → hujum skripti uning sahifasida

# 1) kesh sarlavhalari
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "x-cache|cf-cache-status|age|via|x-varnish|hit"

# 2) kalitga nima kiradi?
grep -rniE "proxy_cache_key|cache_key|CacheKey|Vary" . --include=*.conf --include=*.js | head

# 3) xaridor
curl -s -D- -o /dev/null "https://site.uz/product?id=1" | grep -iE "age|x-cache"

# 1) kеsh yoqligini aniqlash
for I in 1 2 3; do
  curl -s -D- -o /dev/null "https://site.uz/test-anchor" | grep -iE "age|x-cache|cf-cache"
done

# 2) bir xil kalit, turli natija (zaiflik belgisi)
curl -s "https://site.uz/prod?id=1" -H "Accept-Language: ru" -o /tmp/a.html
curl -s "https://site.uz/prod?id=2" -H "Accept-Language: ru" -o /tmp/b.html
diff -q /tmp/a.html /tmp/b.html && echo "  ✗ bir xil — kalit URL ni hisobga olmagan"

# 3) zaharlash (o'z saytingizda)
curl -s -o /dev/null "https://site.uz/prod?id=CANARY-TAKEOVER123"
curl -s "https://site.uz/prod?id=1" | grep -c CANARY-TAKEOVER123 && echo "  ✗ ZAHARLANDI"

# 4) parametr kiritish
curl -s "https://site.uz/?utm_source=1" -o /dev/null
curl -s "https://site.uz/?utm_source=2" -o /dev/null
curl -s -D- -o /dev/null "https://site.uz/" | grep -iE "x-cache|age"

# 5) unkeyed header
curl -s -D- -o /dev/null https://site.uz/ -H "X-Forwarded-Host: CANARY-HOST" \
  | grep -iE "x-forwarded|x-cache"
curl -s https://site.uz/ | grep CANARY-HOST

# 6) web cache deception (maxfiy faylni keshga olish)
for E in /api/user/data.json /admin/panel /static/secret.pdf; do
  echo "  $E: $(curl -s -D- -o /dev/null https://site.uz$E | grep -icE 'x-cache|age')"
done

1. To'g'ri kalit + Vary

proxy_cache_key "$scheme$request_method$host$request_uri";
add_header Vary "Accept-Encoding, Accept-Language" always;
// $request_uri = query string ham kiradi

2. Dinamik javoblarni keshlamaslik

res.set('Cache-Control', 'private, no-store, max-age=0');
// /api/*, /admin/*, sessiya bilan bog'liq hamma narsa
if (req.path.startsWith('/api')) res.set('Cache-Control', 'no-store');

3. Unkeyed header'larni tozalash

proxy_set_header X-Forwarded-Host "";
proxy_set_header X-Forwarded-Port "";
proxy_set_header X-Original-URL "";
// yoki kodda hech ishlatmang

4. Web cache deception

// kesh faqat aniq statik kengaytmalar uchun
location ~* \.(css|js|png|jpg|svg|woff2)$ {{ proxy_cache ... }}
location /api/ {{ proxy_cache off; }}
// "soxta" kengaytma qo'shish: /a.css/../../api/user

5. CDN da

// Cloudflare: Cache Rules → "Bypass cache" /api/* va /admin/* uchun
// "Origin Cache Control" — har doim "Respect origin"

• Kalit to'liq URL + query string bilan
• `Vary` barcha ta'sir qiluvchi header'larda
• `/api/*` va sessiya javoblari `no-store`
• `X-Forwarded-Host` tozalanadi
• Kesh faqat statik fayllar uchun
• Canary bilan zaharlash sinab ko'rildi