Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

HTTP Request Synchronization Defeats Discrepancy Attacks

Cem Topcuoglu, Kaan Onarlioglu, Steven Sprecher, Engin Kirda

TL;DR

This paper addresses discrepancy attacks that arise when HTTP proxies in a multi-hop path process requests inconsistently. It introduces HTTP Request Synchronization, a general defense that propagates an authenticated processing history across hops using standard HTTP extension mechanisms, enabling every proxy to validate processing consistency and terminate on mismatches. The authors implement the scheme on five popular proxies (Apache, NGINX, HAProxy, Varnish, and Cloudflare) and evaluate its effectiveness through three real-world discrepancy attack case studies, as well as performance benchmarks. The results demonstrate practical feasibility and meaningful security gains for layered proxy architectures, suggesting a scalable approach to safer proxied web applications.

Abstract

Contemporary web application architectures involve many layers of proxy services that process traffic. Due to the complexity of HTTP and vendor design decisions, these proxies sometimes process a given request in different ways. Attackers can exploit these processing discrepancies to launch damaging attacks including web cache poisoning and request smuggling. Discrepancy attacks are surging, yet, there exists no systemic defense. In this work, we propose the first comprehensive defense to address this problem, called HTTP Request Synchronization. Our scheme uses standard HTTP extension mechanisms to augment each request with a complete processing history. It propagates this context through the traffic path detailing how each server hop has processed said request. Using this history, every proxy server can validate that their processing is consistent with all previous hops, eliminating discrepancy attacks. We implement our scheme for 5 popular proxy technologies, Apache, NGINX, HAProxy, Varnish, and Cloudflare, demonstrating its practical impact.

HTTP Request Synchronization Defeats Discrepancy Attacks

TL;DR

This paper addresses discrepancy attacks that arise when HTTP proxies in a multi-hop path process requests inconsistently. It introduces HTTP Request Synchronization, a general defense that propagates an authenticated processing history across hops using standard HTTP extension mechanisms, enabling every proxy to validate processing consistency and terminate on mismatches. The authors implement the scheme on five popular proxies (Apache, NGINX, HAProxy, Varnish, and Cloudflare) and evaluate its effectiveness through three real-world discrepancy attack case studies, as well as performance benchmarks. The results demonstrate practical feasibility and meaningful security gains for layered proxy architectures, suggesting a scalable approach to safer proxied web applications.

Abstract

Contemporary web application architectures involve many layers of proxy services that process traffic. Due to the complexity of HTTP and vendor design decisions, these proxies sometimes process a given request in different ways. Attackers can exploit these processing discrepancies to launch damaging attacks including web cache poisoning and request smuggling. Discrepancy attacks are surging, yet, there exists no systemic defense. In this work, we propose the first comprehensive defense to address this problem, called HTTP Request Synchronization. Our scheme uses standard HTTP extension mechanisms to augment each request with a complete processing history. It propagates this context through the traffic path detailing how each server hop has processed said request. Using this history, every proxy server can validate that their processing is consistent with all previous hops, eliminating discrepancy attacks. We implement our scheme for 5 popular proxy technologies, Apache, NGINX, HAProxy, Varnish, and Cloudflare, demonstrating its practical impact.

Paper Structure

This paper contains 23 sections, 9 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. HTTP Essentials
  4. HTTP Extensibility
  5. HTTP Processing Discrepancy Attacks
  6. Attacks & Measurements in Prior Work
  7. Defenses in Prior Work
  8. Research Statement
  9. Design
  10. Implementation
  11. Path and Host Name
  12. Body Length
  13. History Authentication and Integrity
  14. Summary
  15. Evaluation
  16. ...and 8 more sections

Figures (9)

  • Figure 1: Path confusion, leading to web cache deception.
  • Figure 2: Host confusion, leading to web cache poisoning.
  • Figure 3: HTTP Request Synchronization demonstrated with three servers.
  • Figure 4: Implementation with Content-Length encoded body. Blue text indicates the honored values. Red text indicates our enhancements to the original request.
  • Figure 5: Implementation option #2 for requests with chunked body encoding. Total body length is injected into the stream in the penultimate chunk.
  • ...and 4 more figures