Request smuggling: how HTTP/1.1 desync attacks exploit parser disagreement
Traces how HTTP/1.1's two ways of measuring a request body let a front-end and back-end disagree on where one request ends, how CL.TE and TE.CL desync turns that into socket poisoning, and what actually fixes it.
· 21 min read