HTTP Request Smuggling

Request smuggling is the bug James Kettle made famous and that defenders are still catching up to. It exploits a simple structural fact: any time HTTP traffic flows through two parsers in series — CDN to origin, load balancer to app server, reverse proxy to upstream — those two parsers must agree on where one request ends and the next begins. When they disagree by even one byte, the attacker rides the seam. The bug is invisible from logs (the proxy sees one well-formed request; the origin sees two) and the consequences are unbounded: cache poisoning, session theft, WAF bypass, internal-header injection. It's the rare web vulnerability where the network layer itself is what's broken.

HTTP request smuggling appears when intermediaries disagree about request boundaries. That parser mismatch can desynchronize traffic and expose users or internal routes to cross-request impact.

Cache poisoning across CDN edges — one malicious request taints the cached response for every later visitor of that URL. Session hijacking via prepended requests that read responses meant for the next user. WAF bypass — the WAF sees the harmless outer request and forwards bytes that the origin parses as a privileged inner request. Authentication header injection: smuggle a request with `X-Authenticated-User: admin` past a WAF that strips that header on the outer request. Internal-network probing when origin trusts proxy-supplied headers.

Use HTTP/2 end-to-end where possible — its frame-based wire format eliminates the CL/TE ambiguity entirely. When HTTP/1.1 traffic is unavoidable, ensure proxy and origin use the same parser implementation (or at least same conformance posture) and configure both to reject ambiguous requests outright: requests with both Content-Length and Transfer-Encoding headers, requests with malformed chunked encoding, requests with duplicate or whitespace-padded TE headers. Modern load balancers (HAProxy 2.x, nginx 1.21+, AWS ALB) have flags for strict parsing — turn them on. Disable HTTP keep-alive between proxy and origin if you can't otherwise solve it (closes the persistent-connection vector that smuggling exploits, at the cost of latency). Run a tool like Burp's smuggling scanner or HTTP Request Smuggler periodically against your stack — the bug is hard to notice without active probing.