HTTP request smuggling

HTTP request smuggling (HRS) is a security exploit on the HTTP protocol that takes advantage of an inconsistency between the interpretation of Content-Length and Transfer-Encoding headers between HTTP server implementations in a HTTP proxy server chain. It was first documented in 2005 by Linhart et al.

The Transfer-Encoding header works by defining a directive on how to interpret the body of the HTTP request, with the common and necessary directive for this attack being the chunked transfer encoding. When the Transfer-Encoding header is present, the Content-Length header is supposed to be omitted. Working similarly but with a different syntax, the Content-Length header works by specifying the size in bytes of the body as a value in the header itself. Vulnerabilities arise when both of these headers are included in a malicious HTTP request, bypassing security functions meant to prevent malicious HTTP queries to the server by causing either the front-end or back-end server to incorrectly interpret the request. HTTP request smuggling commonly takes the form of CL.TE, TE.CL, or TE.TE, although more complex attacks using HRS do exist.