Http Request Smuggling in Adonisjs with Cockroachdb

HTTP request smuggling arises when an AdonisJS application sits behind a reverse proxy or load balancer and the proxy and the Node.js server interpret HTTP message boundaries differently. CockroachDB, used as the backend database for AdonisJS applications, does not directly cause smuggling, but its presence shapes traffic patterns that can interact with proxy behavior. When AdonisJS routes include CockroachDB queries—such as fetching or updating tenant-specific rows via primary or foreign keys—the database interaction can introduce variable response times and body lengths. These variations can amplify inconsistencies between the proxy and AdonisJS parsing, especially if the proxy relies on content-length headers while AdonisJS processes chunked transfers. An attacker can craft requests where the proxy and AdonisJS interpret the boundary between requests differently, causing one request’s body to be attached to the next. In AdonisJS routes that perform CockroachDB operations, this may lead to authenticated actions being applied under another tenant’s context (a BOLA/IDOR scenario) or allow an unauthorized request to reach a route that the proxy did not intend to expose. The risk increases if route handlers read headers or bodies in a non-deterministic order before validating tenant identifiers, because the smuggled request may exploit the handler’s assumptions about the authenticated user or the SQL query parameters used against CockroachDB.

Remediation focuses on strict message boundary handling and consistent header processing in AdonisJS, independent of CockroachDB. Ensure your AdonisJS application explicitly reads and validates the Content-Length header and does not rely on body parsing heuristics when behind a proxy. Use AdonisJS middleware to normalize incoming requests before they reach routes that execute CockroachDB queries. Below is an example of a custom middleware that enforces a strict transfer encoding and validates the host header to reduce smuggling surface.

// start/hooks/request-validation-hook.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class RequestValidationHook {
  public async handle(ctx: HttpContextContract, next: () => Promise) {
    const request = ctx.request
    // Reject requests with both Transfer-Encoding and Content-Length
    const te = request.header('transfer-encoding')
    const cl = request.header('content-length')
    if (te && cl) {
      ctx.response.status(400).send({ error: 'Invalid headers: conflicting transfer-encoding and content-length' })
      return
    }
    // Enforce host header validation to prevent split routing
    const host = request.header('host') || ''
    if (!host.endsWith('yourdomain.com')) {
      ctx.response.status(400).send({ error: 'Invalid host header' })
      return
    }
    await next()
  }
}

In your route files that interact with CockroachDB, always parameterize queries and avoid concatenating request inputs into SQL strings. Use AdonisJS Lucid ORM placeholders to ensure values are properly escaped. This does not stop smuggling directly, but it prevents a second-order effect where a smuggled request manipulates database operations.

// controllers/ReportsController.ts
import Report from 'App/Models/Report'
import { schema } from '@ioc:Adonis/Core/Validator'

export default class ReportsController {
  public async show({ request, params }: { request: any; params: { id: string } }) {
    const reportId = params.id
    // Validate and sanitize input before using with CockroachDB
    const reportSchema = schema.create({
      id: schema.string({ trim: true, escape: true })
    })
    const validated = await request.validate({ schema: reportSchema })
    const report = await Report.query().where('id', validated.id).preload('tenant').firstOrFail()
    return report
  }
}

Configure your reverse proxy to use consistent HTTP parsing—prefer chunked transfer encoding or fixed content-length, but not both—and terminate TLS at the proxy to avoid protocol ambiguity. In AdonisJS, set the trust proxy setting carefully so that the application’s URL generation and header interpretation align with the proxy’s behavior. Combine this with route-specific middleware that validates tenant context before any CockroachDB call, ensuring that even if smuggling is attempted, the handler will not process cross-tenant data.