HTTP Request Smuggling

// HTTP Request Smuggling - Secure configurations and detection

// SECURE: Express middleware to detect and reject ambiguous requests
app.use((req, res, next) => {
  const transferEncoding = req.get('Transfer-Encoding');
  const contentLength = req.get('Content-Length');
  
  // SECURE: Reject requests with both Transfer-Encoding and Content-Length
  if (transferEncoding && contentLength) {
    console.error('Ambiguous request framing detected:', {
      ip: req.ip,
      url: req.url,
      headers: req.headers
    });
    return res.status(400).json({ 
      error: 'Invalid request: ambiguous Transfer-Encoding and Content-Length' 
    });
  }
  
  // SECURE: Reject multiple Content-Length headers
  const clHeaders = req.rawHeaders.filter((h, i) => 
    i % 2 === 0 && h.toLowerCase() === 'content-length'
  );
  if (clHeaders.length > 1) {
    console.error('Multiple Content-Length headers detected:', req.rawHeaders);
    return res.status(400).json({ 
      error: 'Invalid request: multiple Content-Length headers' 
    });
  }
  
  // SECURE: Validate Transfer-Encoding format
  if (transferEncoding) {
    const normalized = transferEncoding.toLowerCase().trim();
    // Only allow 'chunked', reject obfuscated variants
    if (normalized !== 'chunked') {
      console.error('Invalid Transfer-Encoding:', transferEncoding);
      return res.status(400).json({ 
        error: 'Invalid Transfer-Encoding value' 
      });
    }
  }
  
  next();
});

// SECURE: Admin endpoints on separate internal server
// NOT accessible through public proxy
const adminServer = http.createServer((req, res) => {
  // Validate client certificate (mutual TLS)
  const cert = req.socket.getPeerCertificate();
  if (!cert || !cert.subject) {
    res.writeHead(401);
    return res.end('Unauthorized');
  }
  
  // Validate source IP is internal network
  const clientIP = req.socket.remoteAddress;
  if (!isInternalIP(clientIP)) {
    res.writeHead(403);
    return res.end('Forbidden');
  }
  
  // Admin actions only accessible with proper auth
  if (req.url === '/admin/flush-cache') {
    res.writeHead(200);
    res.end('Cache flushed (authenticated)');
  }
});

// Listen on internal-only interface
adminServer.listen(8081, '127.0.0.1');

function isInternalIP(ip) {
  // Check if IP is in internal ranges
  return ip === '127.0.0.1' || 
         ip.startsWith('10.') || 
         ip.startsWith('192.168.') ||
         ip.startsWith('172.16.');
}

// SECURE: nginx configuration with smuggling protection
/*
upstream backend {
    server localhost:8080;
    # Limit or disable keepalive to prevent request queue issues
    keepalive 0;
}

server {
    listen 80;
    
    # Reject ambiguous framing at the edge
    if ($http_transfer_encoding != "") {
        set $has_te 1;
    }
    if ($http_content_length != "") {
        set $has_cl 1;
    }
    set $ambiguous "${has_te}${has_cl}";
    if ($ambiguous = "11") {
        return 400 "Ambiguous request framing";
    }
    
    location / {
        # Use HTTP/1.1 but disable pipelining
        proxy_pass http://backend;
        proxy_http_version 1.1;
        
        # Normalize Connection header
        proxy_set_header Connection "";
        
        # Don't allow proxy to buffer for smuggling
        proxy_request_buffering on;
        
        # Set timeouts to prevent smuggled requests
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }
    
    # Admin endpoints NOT exposed through public proxy
    location /admin {
        return 403 "Forbidden";
    }
}

# Separate internal admin server
server {
    listen 8081;
    # Only bind to loopback
    bind 127.0.0.1;
    
    # Require client certificates
    ssl_client_certificate /etc/nginx/client-ca.crt;
    ssl_verify_client on;
    
    location /admin {
        proxy_pass http://localhost:8082;
    }
}
*/

// SECURE: Detection and monitoring
app.use((req, res, next) => {
  const originalOn = res.on.bind(res);
  const startTime = Date.now();
  
  res.on('finish', () => {
    const duration = Date.now() - startTime;
    
    // Log suspicious patterns
    if (duration > 30000) {  // 30 second timeout
      console.warn('Suspicious long request:', {
        ip: req.ip,
        url: req.url,
        duration,
        headers: req.headers
      });
    }
  });
  
  next();
});

// SECURE: Rate limiting on connection level
const connectionCounts = new Map();

setInterval(() => {
  // Cleanup old entries
  connectionCounts.clear();
}, 60000);  // Reset every minute

app.use((req, res, next) => {
  const ip = req.ip;
  const count = connectionCounts.get(ip) || 0;
  
  // Detect rapid-fire requests that might indicate smuggling attempts
  if (count > 100) {
    console.error('Rate limit exceeded, possible smuggling:', ip);
    return res.status(429).json({ error: 'Too many requests' });
  }
  
  connectionCounts.set(ip, count + 1);
  next();
});