Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?

1. A The `.css` suffix automatically grants the attacker administrative permissions on the backend API.
2. B The backend ignores the `.css` suffix and serves the victim's private profile HTML. The Gateway, seeing `.css`, caches this HTML publicy. The attacker then visits the same URL and downloads the жертва's cached private data.
3. C The Victim's browser will execute the HTML as a script, sending their password to the Gateway's logs.
4. D It is not possible; API Gateways never cache HTML content by default.