HTTP request smuggling: disagreement on where a request ends

When a front-end proxy and a back-end server share a connection but compute HTTP request boundaries differently, a "smuggled" request can be injected.

CL.TE and TE.CL

If the front-end uses Content-Length and the back-end uses Transfer-Encoding (or vice versa), part of one request's body is read by the back-end as the start of the next request from another user.

POST / HTTP/1.1
Content-Length: 6
Transfer-Encoding: chunked

0

GPOST /admin ...  <- smuggled into the victim's request

Consequences: control bypass, cache poisoning, hijacking others' requests, credential theft.

Defence

Use HTTP/2 end-to-end (removes framing ambiguity). Normalize: front-end and back-end must agree, rejecting requests with both headers or malformed TE. Disable connection reuse to the back-end where unnecessary.