What is HTTP Request Smuggling?

Short answer

HTTP Request Smuggling exploits the fact that a proxy or load balancer in front and the server behind it interpret differently where the same request ends: the attacker sends the Content-Length and Transfer-Encoding headers in a conflicting way and squeezes a second, hidden request into a single connection; the goal is to bypass security checks, poison the cache or affect other users' requests (CWE-444, RFC 9112). In TR7, the first defense is HTTP parsing: TR7 parses and reframes the request itself before forwarding it to the Backend Service, and rejects requests that carry more than one Content-Length, or Content-Length and Transfer-Encoding together, with 400 by default. In WAF, the built-in Signature & Rule Library additionally looks for these patterns with its HTTP Request Smuggling category (8 rules); in Bot Protection, the Protocol Mismatch factor also adds these header combinations to the bot score while the URL Normalization option that loosens parsing is on.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → HTTP Request Smuggling	Listing the rules in the category; changing their state or score
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category tab on the filter strip, the Category row in the record preview	Seeing that the request was caught by a signature in this category
Load Balancer → Actions → URL Normalization	Accept headers not compatible with RFC7230 HTTP/0.9,HTTP/1.0 (Condition independent)	The option that loosens the default strict parsing; it is applied to all vService traffic regardless of the condition
Bot/DDoS Protected vService → Bot/DDoS Management → Bot Protection → Factors	Protocol Hygiene → Protocol Mismatch	Adding a Content-Length sent twice, or Content-Length and Transfer-Encoding arriving together, to the bot score; since the default parsing already rejects these requests with 400, these branches come into play only while the loosening option is on

• The details of the protection against smuggling and parameter pollution, and the configuration steps: Is there protection against HTTP request smuggling and parameter pollution attacks?
• Of the 8 rules of the category, the 3 with 2 points (Low) are scanned only at the Aggressive protection level.

Common Misconceptions

• "There is no risk in a single-server setup." The risk arises from two HTTP layers between the client and the application (ADC, CDN, reverse proxy) interpreting the same request differently; it is evaluated in every architecture that has an intermediate layer in front.
• "Smuggling carries an attack in the content of the request." The actual problem is that the boundaries of the request are made ambiguous; the content can look clean.
• "This protection is provided by WAF signatures." The first and decisive layer is TR7 parsing and reframing the request itself; the signatures and the bot factor are additional layers.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• URL Normalization · RFC Compatibility Options (Backward Compatibility)
• Factors · Protocol Hygiene

Related questions

• Is there protection against HTTP request smuggling and parameter pollution attacks?
• Which attack categories do the signatures cover?
• What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?