Web cache poisoning via HTTP:2 request tunnelling

A demonstration of a Portswigger Web Security Academy exercise.

A lecture for a Securing Web Applications class

[salt]

Thanks a lot for your video!
I did the other HTTP smuggling tunnelling and in this one to perform the CRLF we need to inject your HTTP request in the last ?cachebuster=1 HTTP/1.1
--- INSIDE THE NAME OF THE LAST REQUEST HEADER
foo: bar\r\n
Host: abc\r\n\r\n


---- INSIDE THE VALUE OF THE LAST REQUEST HEADER ---
xyz


So it works in the other challenge but in this one and I don't understand why.