Matteo Golinelli
Matteo Golinelli
Home
News
Publications
Posts
CV
Light
Dark
Automatic
web security
Hidden Web Caches Discovery
Web caches play a crucial role in web performance and scalability. However, detecting cached responses is challenging when web servers …
Matteo Golinelli
,
Bruno Crispo
PDF
Cite
Code
DOI
Can the Date Header Be Used to Detect Caching?
No. But actually, not really. Web Caches Let’s start with some background. Web caches are in-the-middle components physically located between a client and an origin web server. They are used to reduce the latency of HTTP requests by storing the responses of the server and serving them to the client when the same request is made again.
Matteo Golinelli
Nov 15, 2023
5 min read
OAuth 2.0 Redirect URI Validation Falls Short Literally
OAuth 2.0 requires a complex redirection trail between websites and Identity Providers (IdPs). In particular, the “redirect …
Tommaso Innocenti
,
Matteo Golinelli
,
Kaan Onarlioglu
,
Ali Mirheidari
,
Bruno Crispo
,
Engin Kirda
PDF
Cite
Code
DOI
The Nonce-nce of Web Security: An Investigation of CSP Nonces Reuse
Content Security Policy (CSP) is an effective security mechanism that prevents the exploitation of Cross-Site Scripting (XSS) …
Matteo Golinelli
,
Francesco Bonomi
,
Bruno Crispo
Cite
Code
arXiv
On Springer (paid access)
Mind the CORS
Cross-Origin Resource Sharing (CORS) is a mechanism to relax the security rules imposed by the Same-Origin Policy (SOP), which can be …
Matteo Golinelli
,
Elham Arshad
,
Dmytro Kashchuk
,
Bruno Crispo
PDF
Cite
Code
IEEE Xplore
Web Cache Deception leads to Cache Poisoning
Web cache poisoning is an attack that allows an attacker to trick a web cache into storing malicious content (such as malicious JavaScript). This content is then served to all the unsuspecting users that request the poisoned URL 1.
Matteo Golinelli
Last updated on Aug 24, 2023
3 min read
Web Cache Deception Escalates!
Web Cache Deception (WCD) tricks a web cache into erroneously storing sensitive content, thereby making it widely accessible on the …
Seyed Ali Mirheidari
,
Matteo Golinelli
,
Kaan Onarlioglu
,
Engin Kirda
,
Bruno Crispo
PDF
Cite
Code
Slides
Video
On USENIX
Cite
×