Agent Wranglers

Recommended

Make every server agree where a request ends

Refuse every request whose length is unclear, so a proxy and the app behind it never read one request as two.

By Agent Wranglers. Updated .

Applies when

The project runs its own servers, virtual machines or containers.

How to do it

Request smuggling hides a second request inside the first. It works when a CDN, load balancer or proxy reads the length differently from the app server. RFC 9112 says a request with both Transfer-Encoding and Content-Length ought to be handled as an error. Refuse it at the edge with 400 and close the connection. Refuse two different Content-Length headers and any Transfer-Encoding other than chunked the same way. Use HTTP/2 from the proxy to the app where both support it. Keep the proxy and the app server current, as keep software current and quiet says, because most smuggling holes are parser bugs.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

HTTP example

POST /search HTTP/1.1
Host: staging.example.com
Content-Length: 4
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1

HTTP/1.1 400 Bad Request
Connection: close

How to check

On the test copy, send a request through the front proxy with both Content-Length: 4 and Transfer-Encoding: chunked. Then send one with two different Content-Length headers. Both get 400, and the proxy closes the connection.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/request-smuggling">Agent Wranglers security testing playbook</a>. In code you write, add a comment next to it with the same link.