Cache purge requests are not authenticated

How it was found

Summary:

Hello team, Anyone can issue a PURGE request for any resource and invalidate your caches. That can lead to increased bandwidth costs but also potential Denial of Service attacks.

Steps To Reproduce:

[add details for how we can reproduce the issue]

1.{Fundefined}

Unauthenticated cache purge request:

curl 'https://curl.se/' -X PURGE { "status": "ok", "id": "21729-1683784658-593921" }
2.{Fundefined}

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

• [attachment / reference] https://sapt.medium.com/apple-hall-of-fame-for-a-small-misconfiguration-unauth-cache-purging-faf81b19419b

Impact

That can lead to increased bandwidth costs but also potential Denial of Service attacks