Collected research

Empirical Study of HTTP Request Smuggling in Servers and Proxies

Mattias Grenfeldt and Asta Olofsson · kth.diva-portal.org

A systematic test of six open-source proxies and six servers for HTTP request smuggling, sending a corpus of every known desync variant and comparing how each pair interprets message length. It found 17 parsing behaviours that disagree with the specification, and proxy-server combinations that let an attacker smuggle a second request past the front end to reach forbidden paths.

Record

Researcher

Mattias Grenfeldt and Asta Olofsson

Published by

kth.diva-portal.org

Format

Whitepaper

Topic

HTTP

In the archive

• Collected in the 2021 research round

Tags

• request-smuggling
• desync
• parser-differential
• auth-bypass
• http
• proxy
• reverse-proxy
• measurement-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Mattias Grenfeldt and Asta Olofsson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.