HTTP Request Smuggling

What Is Broken and Why

HTTP request smuggling arises from ambiguity in how HTTP/1.1 allows both Content-Length and Transfer-Encoding headers simultaneously. When a front-end proxy and back-end server disagree on which header takes precedence, an attacker can craft a request whose body is interpreted differently by each hop. The "leftover" bytes from one request are prepended to the next user's request, allowing attackers to poison the request pipeline, bypass security controls, hijack sessions, and perform reflected XSS without user interaction.

Key Signals

• Application sits behind a reverse proxy, load balancer, or CDN
• Delayed response to a crafted request with conflicting length headers (timing-based detection)
• Different HTTP response when Transfer-Encoding: chunked and Content-Length headers are both present
• 400 Bad Request or 500 from back-end on specific header combinations
• Burp's HTTP Request Smuggler extension flagging the endpoint
• Front-end rewrites or strips certain headers (evidence in X-Forwarded-* reflection)