HTTP Header Normalization and Request Smuggling Prevention
Description
Enforce strict HTTP header parsing on all HTTP intermediaries (proxies, load balancers, reverse proxies, web servers) to prevent request smuggling via header desynchronization. The control requires: (1) rejecting requests containing both Content-Length and Transfer-Encoding headers per RFC 7230 Section 3.3.3, (2) rejecting requests with duplicate Content-Length headers carrying differing values, (3) disabling relaxed header parsing modes that tolerate whitespace or encoding variations in Transfer-Encoding values, and (4) normalizing or rejecting header values containing illegal characters (bare CR, bare LF, NUL bytes). These measures eliminate the primary desynchronization vectors that enable an attacker to inject smuggled requests across the proxy-backend boundary.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Strict header normalization closes the standard CL/TE and duplicate-CL desync vectors, forcing the attacker to discover novel parser-specific bypass techniques to achieve smuggling |
| Integrity (I) | H → L | Preventing request smuggling eliminates the primary integrity impact: cache poisoning and request injection into other users sessions |
CWE Relationships
Verification
Verify that HTTP intermediaries enforce strict header parsing: reject requests with both Content-Length and Transfer-Encoding, reject duplicate Content-Length headers, and disable relaxed parsing modes
# Expected: off
# Expected: http-request deny
# Expected: Strict
# Expected: on