Request Smuggling in Express with Basic Auth

Request smuggling occurs when an intermediary (such as a load balancer or reverse proxy) and an origin server interpret the boundaries of an HTTP request differently. In Express applications that rely on Basic Auth, the risk is amplified when authentication headers are handled inconsistently across these layers. If a proxy normalizes or strips headers before forwarding, while Express parses the raw header stream, an attacker can craft a request where the Content-Length and Transfer-Encoding headers conflict. This causes one layer to treat the body as part of the next request, leading to request splitting or request injection.

When Basic Auth is involved, the Authorization header often flows through multiple layers. A common pattern is a proxy adding or rewriting Authorization for backend services, while Express still parses the original, potentially malformed header. If the proxy treats a smuggled request as authenticated due to its own header manipulation, the backend may execute privileged logic without proper validation. For example, an attacker can send a request like:

POST /api/users HTTP/1.1
Host: api.example.com
Content-Length: 44
Transfer-Encoding: chunked
Authorization: Basic dXNlcjpwYXNz

0

GET /admin/export HTTP/1.1
Host: api.example.com
Authorization: Basic dXNlcjpwYXNz

If the proxy and Express interpret the boundary differently, the second request may be processed with the same authentication context, bypassing intended access controls. This is especially dangerous when the backend performs sensitive operations based on parsed route handlers without revalidating the request line. The smuggled request can lead to unauthorized data access or unintended actions, and because the request appears authenticated, audit logs may incorrectly attribute the action to a valid user.

middleBrick identifies this by correlating OpenAPI/Swagger spec definitions (including security schemes using Basic Auth) with runtime behavior. It flags inconsistencies between declared authentication requirements and observed header handling, including scenarios where smuggling could bypass authentication or authorization checks. The scan tests unauthenticated attack surfaces, so even endpoints that expect Basic Auth are probed without credentials to detect structural vulnerabilities.

To mitigate request smuggling in Express with Basic Auth, ensure consistent header parsing and avoid relying on potentially modified headers from proxies. Always validate the request line and body independently, and normalize headers before authentication checks. Below are concrete code examples that demonstrate secure handling.

1. Explicitly reject ambiguous encodings

Prevent the server from interpreting both Content-Length and Transfer-Encoding by rejecting requests that contain both. This eliminates one of the primary vectors for request splitting.

const express = require('express');
const app = express();

app.use((req, res, next) => {
  if (req.headers['content-length'] && req.headers['transfer-encoding']) {
    return res.status(400).send('Invalid headers: Content-Length and Transfer-Encoding');
  }
  next();
});

app.get('/secure', (req, res) => {
  res.send('Request passed validation');
});

app.listen(3000);

2. Normalize Authorization header before authentication

Ensure that only a single, canonical Authorization header is used for Basic Auth validation. Strip any duplicate or forwarded headers that may have been introduced by proxies.

const authHeader = req.headers.authorization;
if (!authHeader || !authHeader.startsWith('Basic ')) {
  return res.status(401).send('Unauthorized');
}

const base64Credentials = authHeader.split(' ')[1];
const credentials = Buffer.from(base64Credentials, 'base64').toString('ascii');
const [username, password] = credentials.split(':');

if (username !== 'admin' || password !== 's3cur3P@ss') {
  return res.status(403).send('Forbidden');
}

res.send('Authenticated');

3. Use a reverse proxy-aware configuration

If behind a trusted proxy, configure Express to trust the proxy and normalize headers like X-Forwarded-Proto, but do not trust X-Forwarded-For or X-Forwarded-Host for security decisions without strict validation.

app.set('trust proxy', 1); // trust first proxy
app.use((req, res, next) => {
  // Explicitly use the original host, not the forwarded one
  req.secure = req.header('x-forwarded-proto') === 'https';
  next();
});

middleBrick’s scans include checks for inconsistent header handling and missing validation around authentication headers. The tool correlates findings with compliance frameworks and provides prioritized remediation guidance, helping teams address smuggling risks before they can be exploited.