Request Smuggling in Adonisjs with Dynamodb

Request smuggling occurs when an application processes HTTP requests differently between a frontend proxy/load balancer and the application server, allowing attackers to smuggle requests across security boundaries. This specific combination—AdonisJS applications that interact with DynamoDB—can expose smuggling risks when request parsing and routing are inconsistent between layers.

AdonisJS, a Node.js web framework, relies on its HTTP server pipeline to parse incoming requests and route them to controllers. If the application uses chunked transfer encoding or inconsistent content-length handling while proxying to DynamoDB data endpoints (for example, when writing items that include nested metadata or conditional headers), a misaligned Content-Length or Transfer-Encoding between the proxy and AdonisJS can cause one request to be interpreted as two or more requests by the backend. This becomes critical when requests perform operations such as PutCommand or UpdateCommand against a DynamoDB table, where a smuggled request may execute under a different authorization context than intended.

DynamoDB itself does not parse HTTP; it receives requests forwarded by the application. Therefore, if AdonisJS routes a smuggled request to a DynamoDB GetItem or Query call that assumes a specific user identity derived from earlier pipeline processing, the smuggled request may access or modify data belonging to another user. For example, an attacker may smuggle a request that reuses a signed URL or an internal SDK call to retrieve another user’s item from a DynamoDB table, effectively performing an Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA).

Consider an AdonisJS route that accepts a POST to create a DynamoDB record. If the route parses the request body once for validation and then passes the same stream to the DynamoDB client without resetting or buffering, a proxy that interprets Transfer-Encoding: chunked differently may allow a second request to be appended and processed by the same route handler. This second request could be a PutCommand targeting a different partition key, leading to unauthorized data creation or overwrites. Real-world attack patterns include CVE-adjacent scenarios where inconsistent header parsing leads to privilege escalation across tenant boundaries.

To detect this with middleBrick, you can scan the unauthenticated attack surface of your AdonisJS endpoint. The scanner runs 12 checks in parallel, including BOLA/IDOR and Unsafe Consumption, to surface request smuggling risks specific to your DynamoDB integration. Findings include severity and remediation guidance mapped to frameworks such as OWASP API Top 10.

Remediation focuses on ensuring consistent request parsing and isolation between the AdonisJS layer and DynamoDB operations. You should normalize headers before forwarding to DynamoDB, avoid streaming the same request body to multiple consumers, and enforce strict content-length validation for operations that invoke AWS SDK commands such as PutCommand, UpdateCommand, or GetItem.

In AdonisJS, configure the HTTP pipeline to buffer and validate request bodies before passing them to DynamoDB. Use middleware to ensure that Content-Length and Transfer-Encoding are not both present, and that chunked encoding is handled consistently. Below are concrete examples using the AWS SDK for JavaScript v3 within an AdonisJS controller.

Example: Safe PutItem with explicit content-length validation

import { DynamoDBClient, PutCommand } from "@aws-sdk/client-dynamodb";
import { writeFileSync } from "fs";

const client = new DynamoDBClient({ region: "us-east-1" });

async function createItem(tableName, item) {
  // Validate content length and avoid streaming reuse
  const body = JSON.stringify(item);
  const encoder = new TextEncoder();
  const payload = encoder.encode(body);
  
  // Ensure Content-Length is set explicitly when behind a proxy
  const command = new PutCommand({
    TableName: tableName,
    Item: item,
  });

  // Explicitly set user-agent and content-length headers if needed
  const customMiddleware = {
    applyToStack: (context) => {
      context.requestFns.push(async (req, res, next) => {
        req.headers.set("x-content-length", payload.length.toString());
        return next();
      });
    }
  };

  try {
    const response = await client.send(command);
    return response;
  } catch (error) {
    // Log and handle conditional check failures (e.g., ConditionalCheckFailedException)
    console.error("DynamoDB PutCommand failed:", error);
    throw error;
  }
}

Example: Query with partition-key isolation to prevent BOLA

import { DynamoDBClient, GetCommand } from "@aws-sdk/client-dynamodb";

const client = new DynamoDBClient({ region: "us-east-1" });

async function getItemByUser(tableName, userId, itemId) {
  // Enforce partition-key ownership to avoid IDOR
  const command = new GetCommand({
    TableName: tableName,
    Key: {
      pk: { S: `USER#${userId}` },
      sk: { S: `ITEM#${itemId}` },
    },
  });

  const response = await client.send(command);
  if (!response.Item) {
    throw new Error("Item not found or access denied");
  }
  return response.Item;
}

Example: Middleware to normalize headers and prevent smuggling

import { HttpContextContract } from "@ioc:AdonisJS/Core/HttpContext";

export default class RequestSanitizationMiddleware {
  public async handle(ctx: HttpContextContract, next: () => Promise) {
    const req = ctx.request;
    const rawHeaders = req.headers();

    // Remove ambiguous Transfer-Encoding if Content-Length is present
    if (rawHeaders["content-length"] && rawHeaders["transfer-encoding"]) {
      req.removeHeader("transfer-encoding");
    }

    // Ensure body is read once and buffered
    if (req.hasBody()) {
      const body = await req.body();
      ctx.request.body = body; // replace stream with buffered body
    }

    await next();
  }
}

By combining these practices—explicit header normalization, single-consumption of request bodies, and partition-key-aware DynamoDB commands—you reduce the risk that a smuggled request reaches DynamoDB with an unintended authorization context. middleBrick’s checks for BOLA/IDOR and Unsafe Consumption can surface misconfigurations in your AdonisJS routes before they reach production.