HTTP request smuggling and message framing

Mechanism

Smuggling requires two HTTP parsers to disagree about where one request ends and the next begins. The relevant architecture usually includes a frontend and a backend sharing persistent connections. Conflicting length information, unusual transfer-encoding parsing, or protocol downgrade can make the backend interpret leftover bytes as another request. A malformed request to a single server is insufficient.

Practical method

Identify proxy layers and protocols first. Use a disposable lab with independent client sessions and compare frontend and backend request logs. Construct framing experiments conservatively and observe whether a second recognizable request reaches the backend. Distinguish a connection timeout from a stable desynchronization and account for connection reuse.

client -> frontend parser -> shared connection -> backend parser
          boundary A                           boundary B
          mismatch leaves bytes for a later request

Interpreting evidence

Backend logs that attribute the same byte stream to different request boundaries provide stronger evidence than a lone delay. Record exact line endings, headers, body length, and negotiated protocols; text editors can silently alter the experiment.

Pitfalls and limits

HTTP/2 changes the framing model but downgrades can reintroduce ambiguity. Browser behavior may prevent sending a laboratory byte stream. Tests can interfere with another request on a shared backend connection, so isolate the fixture.