HTTP Request Smuggling

HTTP request smuggling is an attack that abuses inconsistent parsing of message boundaries between two HTTP processors, typically a reverse proxy or CDN and an origin server. The attacker sends an ambiguous request so the proxy sees one request while the backend sees two, "smuggling" a hidden request into another user's connection.

Why it matters

The ambiguity usually comes from the Content-Length and Transfer-Encoding: chunked headers, or from HTTP/2 to HTTP/1.1 downgrades. Impact can include bypassing front-end access controls, poisoning caches, capturing other users' requests and delivering reflected attacks without any user click. It is hard to detect because everything looks like valid HTTP to each component alone.

Mitigations include keeping proxies and servers patched, rejecting requests that contain both headers, normalizing at the edge, and using HTTP/2 end to end where possible.

Example

A classic ambiguous shape, simplified:

POST / HTTP/1.1
Host: example.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

If the front end honors Content-Length and the back end honors Transfer-Encoding, SMUGGLED becomes the start of the next request.

Common mistakes

• Running mismatched proxy and origin software without testing the combination.
• Assuming a WAF will catch malformed framing.
• Leaving upstream connection reuse enabled without strict parsing.

Related

• Reverse proxy
• WAF
• HTTP/2
• Man-in-the-middle attack

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.