Agent Wranglers

APS-48Recommended

Make every server agree where a request ends

Refuse every request whose length is unclear, so a proxy and the app behind it never read one request as two.

By Agent Wranglers. Updated .

How to do it

Request smuggling hides a second request inside the first. It works when a CDN, load balancer or proxy reads the length differently from the app server. RFC 9112 says a request with both Transfer-Encoding and Content-Length ought to be handled as an error. Refuse it at the edge with 400 and close the connection. Refuse two different Content-Length headers and any Transfer-Encoding other than chunked the same way. Use HTTP/2 from the proxy to the app where both support it. Keep the proxy and the app server current, as keep software current and quiet says, because most smuggling holes are parser bugs.

Examples

HTTP example

POST /search HTTP/1.1
Host: staging.example.com
Content-Length: 4
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1

HTTP/1.1 400 Bad Request
Connection: close

How to check

On the test copy, send a request through the front proxy with both Content-Length: 4 and Transfer-Encoding: chunked. Then send one with two different Content-Length headers. Both get 400, and the proxy closes the connection.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/requests-files-and-caches/request-smuggling">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.