HTTP Request Smuggling
Critical · Protocol · CWE-444 · OWASP A05:2021
Description
Front/back servers parse HTTP boundaries differently.
Root cause
Conflicting Content-Length and Transfer-Encoding.
Impact
Cache poisoning, auth bypass, request hijacking.
Detection
Differential response testing in authorized labs.
Mitigation
Normalize parsing; disable ambiguous TE; HTTP/2 end-to-end.
Secure coding
Use hardened reverse proxies with consistent parsing.
Safe lab example
PortSwigger request smuggling labs
Practise related skills in Labs or deepen on Academy library.