What Is HTTP Request Smuggling?
HTTP request smuggling exploits a disagreement between two servers — typically a front-end proxy and a back-end server — about where one HTTP request ends and the next begins. By crafting ambiguous headers, an attacker gets the two systems to parse the same bytes differently, smuggling hidden request content that the back-end attributes to the next user. It is a subtle, high-impact class of attack.
How does a desync happen?#
The ambiguity usually lives between two ways of specifying body length:
POST / HTTP/1.1
Content-Length: 6
Transfer-Encoding: chunked
0
SMUGGLEDIf the front-end honors Transfer-Encoding and the back-end honors Content-Length (or vice
versa), they disagree about where the request ends. The leftover bytes (SMUGGLED) get prepended
to whatever request comes next on that connection — often another user’s.
What can an attacker do with it?#
Because the attack corrupts a shared connection, the impact spreads:
| Effect | Consequence |
|---|---|
| Prefix a victim’s request | Redirect them, steal their session |
| Bypass front-end controls | Reach filtered or internal paths |
| Capture requests | Harvest other users’ credentials |
| Cache poisoning | Serve malicious content to many users |
How is it prevented?#
The fix is eliminating parsing ambiguity end to end:
- Use HTTP/2 end to end where possible — its framing removes the length ambiguity.
- Normalize at the front-end — reject requests with both
Content-LengthandTransfer-Encoding. - Ensure proxy and origin parse identically, and keep them patched.
Request smuggling is an infrastructure-level flaw that can enable cache poisoning. More at the Web Security hub.
Frequently asked questions#
What is HTTP request smuggling?
HTTP request smuggling exploits inconsistencies in how a front-end proxy and a back-end server determine where one request ends and the next begins, usually via conflicting Content-Length and Transfer-Encoding headers. The attacker smuggles part of a request that the back-end treats as the start of the next victim’s request.
What can request smuggling achieve?
It can poison the connection so a victim’s request is prefixed with attacker content, bypass front-end security controls, capture other users’ requests and credentials, and enable cache poisoning. Because it corrupts the shared request stream, one attacker request can affect many subsequent users on the same connection.