How HTTP Request Smuggling Works and How to Defend Against It

HTTP Request Smuggling is a web attack that exploits inconsistencies in how front-end proxies and back-end servers parse HTTP/1.1 requests, particularly when both Content-Length and Transfer-Encoding headers are present. Attackers can craft malformed requests that cause one server to treat leftover data as a new, separate request, effectively bypassing security controls. The technique enables serious harms including WAF bypass, cache poisoning, session hijacking, and credential theft. Mitigations include adopting HTTP/2 end-to-end, rejecting requests with conflicting length headers, and normalizing requests at the proxy layer. Application-level defenses such as strict HTTP parsing, connection timeouts, and anomaly monitoring further reduce the attack surface.