Request smuggling
HTTP request smuggling (CWE-444). A front end and a back end disagree about where one request ends, so an attacker hides a second request inside the first.
- Also called
- HTTP request smuggling · HTTP desync
- Defined in
- MITRE CWE-444
- Identifiers
- CWE-444: HTTP request smuggling
Covered in
Guide
Keep HTTP request boundaries consistent across intermediaries
Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.
Guide
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Practice: Local project: Repair a real proxy and shared cache