Collected research

Weird proxies/2 and a bit of magic

GreenDog · Speaker Deck · 1 September 2021

A survey of reverse proxy and API gateway misconfigurations in which the front end and back end disagree about a request. Path normalization gaps, raw bytes and absolute URIs in the request line, header name mangling, Range-header cache poisoning and HTTP/2 pseudo-header downgrades let an attacker reach restricted paths, smuggle trusted headers, or poison a cache.

Record

Researcher

GreenDog

Published by

Speaker Deck

Date

1 September 2021

Format

Slides

Topic

Other

In the archive

• Collected in the 2021 research round

Related sources

• Research results
• Aleksei Tiurin – Weird proxies/2 and a bit of magic

Tags

• parser-differential
• request-smuggling
• header-injection
• cache-poisoning
• path-traversal
• auth-bypass
• reverse-proxy
• proxy
• http2
• cdn
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of GreenDog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.