Cache Poisoning in Strapi with Dynamodb

Cache poisoning in the context of Strapi with DynamoDB arises when unvalidated or attacker-controlled input influences cache keys or cache entries, causing malicious or unintended content to be served to users. Strapi, as a headless CMS, often uses caching to improve performance. When the caching layer relies on raw request parameters or dynamic keys derived from user-supplied data without proper normalization, an attacker can manipulate keys to overwrite legitimate cache entries or poison shared cache spaces.

DynamoDB is commonly used as a persistence or cache store for Strapi when deployed in distributed environments. If Strapi generates cache keys using unescaped user input such as query parameters, locale, or API paths, and stores them directly in DynamoDB, an attacker can inject crafted input to create or modify cache keys. This can lead to two outcomes: cache key collision, where attacker-controlled data replaces legitimate cached responses, and cache pollution, where arbitrary or malicious content is stored under predictable keys. For example, an attacker could supply a crafted locale or slug parameter to cause Strapi to cache a response under a key like /products/en/../attacker-controlled, which then gets served to other users.

Furthermore, DynamoDB’s schema-less nature can amplify the risk if Strapi does not enforce strict key formats or validate input before writing to the table. An attacker may exploit missing normalization (e.g., case sensitivity, whitespace, special characters) to create multiple variants of the same logical cache entry, causing cache fragmentation or bypassing intended cache reuse. In a shared cache architecture, this may expose sensitive data if one tenant’s poisoned key collides with another’s, or it may degrade performance by flooding the cache with useless entries. Strapi’s default behavior of using request-derived identifiers without canonicalization, combined with DynamoDB’s eventual consistency model in some configurations, can delay cache invalidation and allow poisoned entries to persist longer than expected.

To mitigate cache poisoning when using DynamoDB with Strapi, enforce strict input validation, canonicalize cache keys, and isolate tenant or user-specific data. Use a deterministic key generation strategy that normalizes inputs and incorporates a version or namespace to prevent cross-tenant pollution. Below are concrete code examples for Strapi custom controllers or services that safely interact with DynamoDB.

1. Canonicalize and validate cache keys

Normalize user inputs such as locale, slug, or query parameters before using them in cache keys. Strip or encode unsafe characters and enforce a strict format.

// src/utils/cache-key.js
const crypto = require('node:crypto');

/**
 * Generate a deterministic, safe cache key for Strapi entities.
 * @param {string} base - e.g., 'api::product.product'
 * @param {Object} params - validated and normalized params
 * @returns {string} hex hash used as a cache key
 */
function generateCacheKey(base, params) {
  const normalized = {
    locale: params.locale ? params.locale.toLowerCase().replace(/[^a-z0-9-]/g, '') : 'en',
    slug: params.slug ? params.slug.trim().replace(/[^a-z0-9-]/g, '') : '',
    prefix: params._prefix || 'v1',
  };
  const payload = `${base}:${normalized.locale}:${normalized.slug}:${normalized.prefix}`;
  return crypto.createHash('sha256').update(payload).digest('hex');
}

module.exports = { generateCacheKey };

2. Safe DynamoDB put/get with Strapi service

Use the AWS SDK to interact with DynamoDB, ensuring keys are canonicalized and scoped to avoid cross-tenant writes. Include a namespace derived from Strapi’s UID or environment to isolate caches.

// src/services/dynamo-cache.js
const { DynamoDBClient, GetItemCommand, PutItemCommand } = require('@aws-sdk/client-dynamodb');
const { marshall, unmarshall } = require('@aws-sdk/util-dynamodb');
const { generateCacheKey } = require('../utils/cache-key');

const client = new DynamoDBClient({ region: process.env.AWS_REGION || 'us-east-1' });

/**
 * Retrieve cached response from DynamoDB.
 * @param {string} baseEntity - e.g., 'api::product.product'
 * @param {Object} params - request params used to derive cache key
 * @returns {Promise}
 */
async function getFromCache(baseEntity, params) {
  const key = generateCacheKey(baseEntity, params);
  const cmd = new GetItemCommand({
    TableName: process.env.DYNAMO_CACHE_TABLE,
    Key: marshall({ pk: `CACHE#${key}`, sk: 'response' }),
  });
  const resp = await client.send(cmd);
  return resp.Item ? unmarshall(resp.Item) : null;
}

/**
 * Write response to DynamoDB cache with namespaced key.
 * @param {string} baseEntity
 * @param {Object} params
 * @param {Object} data
 * @param {number} ttlSeconds
 */
async function setInCache(baseEntity, params, data, ttlSeconds) {
  const key = generateCacheKey(baseEntity, params);
  const item = {
    pk: { S: `CACHE#${key}` },
    sk: { S: 'response' },
    body: { S: JSON.stringify(data) },
    exp: { N: String(Math.floor(Date.now() / 1000) + ttlSeconds) },
  };
  const cmd = new PutItemCommand({
    TableName: process.env.DYNAMO_CACHE_TABLE,
    Item: marshall(item),
  });
  await client.send(cmd);
}

module.exports = { getFromCache, setInCache };

3. Strapi controller usage with scoped namespace

In your Strapi controller, incorporate the canonical key and a namespace derived from the plugin/UID or environment to prevent cross-tenant cache pollution.

// src/api/product/controllers/product.js
const { getFromCache, setInCache } = require('../../../../services/dynamo-cache');

module.exports = {
  async find(ctx) {
    const { locale = 'en', slug, _namespace } = ctx.query;
    const namespace = _namespace || 'strapi::api::product';
    const cacheKey = {
      locale,
      slug: slug || 'home',
      _prefix: namespace,
    };

    const cached = await getFromCache(namespace, cacheKey);
    if (cached) {
      return cached;
    }

    // Fetch from database via Strapi service
    const result = await strapi.entityService.findMany('api::product.product', {
      filters: { slug }, locale,
    });

    await setInCache(namespace, cacheKey, result, 300); // cache 5 minutes
    return result;
  },
};

4. Security and compliance mappings

These practices align with OWASP API Top 10 (2023) A05:2021 — Security Misconfiguration and A03:2021 — Injection, and support compliance with frameworks such as PCI-DSS and SOC 2 by ensuring cache isolation and input validation. For API security scanning, middleBrick can detect misconfigured caching and missing input canonicalization as part of its cache poisoning and input validation checks, providing prioritized findings with remediation guidance.