Intermediate LevelWeb Security & Cyber Defense
What is HTTP Request Smuggling (CL.TE / TE.CL desync) between reverse proxies and backends?
❓ Interview Prompt: Explain HTTP Request Smuggling, Front-end proxy vs Back-end server desynchronization, `Content-Length` vs `Transfer-Encoding`, and request hijacking.
HTTP Request Smuggling occurs when a front-end reverse proxy and a back-end web server disagree on where HTTP request boundaries end when processing HTTP/1.1 pipelines:
CL.TE Desynchronization:
•
Front-end proxy uses 'Content-Length' (CL) to determine request length.
•
Back-end server uses 'Transfer-Encoding: chunked' (TE).
•
Attacker constructs a request with both headers. The back-end server stops parsing early, leaving the remaining payload bytes lingering in the TCP stream to smuggle into the NEXT user's request!
Code Implementation Example
http
// CL.TE Smuggling Payload:
POST / HTTP/1.1
Host: example.com
Content-Length: 13
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Foo: x💡HTTP Request Smuggling CL.TE desynchronization payload.
🎯 Interview Key Takeaway
Mitigate HTTP Request Smuggling by upgrading internal microservice traffic to HTTP/2 or disabling HTTP/1.1 pipelining.
#Request Smuggling#CL.TE#HTTP Parsing#Intermediate
Back to all Web Security & Cyber Defense Questions→