What Is HTTP Request Smuggling? Desync Attacks Explained Simply
HTTP request smuggling (also called a desync attack) happens when two servers disagree about where one HTTP message ends.
The front-end thinks it forwarded one request. The back-end thinks it received two. That leftover “half request” can stick to the next user’s traffic.
PortSwigger’s research brought modern desync attacks back into the mainstream. This primer keeps the mental model light so you can learn without drowning in acronyms.
Quick takeaway: Ambiguous length headers → parser disagreement → attacker prefix attaches to someone else’s request → stolen sessions, poisoned caches, or control bypasses.
The disagreement in one picture (words)
Common conflict:
- One side trusts Content-Length
- The other trusts Transfer-Encoding: chunked
You craft a body that looks like “one request” to A and “two requests” to B.
You will also see newer variants (CL.0, TE.0, HTTP/2 downgrade quirks). Learn classic CL.TE / TE.CL first.
What can go wrong for users
Successful desync can lead to:
- Stealing another user’s request (cookies, tokens, internal headers)
- Cache poisoning on login or static pages
- Skipping front-end security checks
- Hitting unexpected back-end routes
Impact is often critical. Reproduction is delicate. Prefer labs and programs that clearly allow smuggling tests.
How to study without breaking production
- Complete PortSwigger Academy smuggling labs
- Read PortSwigger Research notes on desync / HTTP/2 follow-ups
- Only then touch live programs that list smuggling in scope
On live tests:
- Start with harmless paths
- Save raw bytes (whitespace matters)
- Note the CDN / proxy vendor
- Avoid destructive methods unless explicitly allowed
Fixes worth recommending
- Reject ambiguous CL + TE combinations at the edge
- Normalize requests before they hit origin
- Reduce confusing HTTP/1.1 downgrade paths
- Keep parsers consistent across the chain
Original Bugflare article. Based on publicly documented PortSwigger request-smuggling research. Unauthorized desync testing can disrupt production — follow program policy.