Http Request Smuggling in Chi with Cockroachdb

HTTP request smuggling occurs when an application processes HTTP requests differently in transit versus after they reach the backend, enabling attackers to smuggle requests across security boundaries. In a Chi application backed by Cockroachdb, the risk arises from how requests are routed, parsed, and forwarded—especially when a proxy or load balancer terminates TLS and forwards requests to a Chi service.

Chi is a minimal, composable router for Clojure web applications. When used with Cockroachdb as the persistent store, the typical flow involves a client request reaching a reverse proxy (or API gateway), being parsed into a Ring request map, and then passed to Chi routes. If the proxy and Chi handle headers such as Transfer-Encoding or Content-Length inconsistently, an attacker can craft a request that is interpreted differently by each hop. This can cause a smuggled request to be queued for a different route or backend, bypassing intended access controls.

Consider a setup where TLS is terminated at the proxy, which then forwards requests to Chi on HTTP. If the proxy normalizes headers differently than Chi—say, it removes or rewrites Transfer-Encoding: chunked while Chi still parses the body based on an older header—an attacker can inject a second request that the proxy treats as part of the first request, but Chi processes independently. Because Cockroachdb stores user sessions and authorization state, a smuggled request might operate under the permissions of the previous user or service account, leading to unauthorized data access or mutation.

In practice, this maps to the BOLA/IDOR and Authentication categories in middleBrick’s 12 checks. A smuggled request can bypass route-level authentication or object-level permissions, allowing one user to act as another. middleBrick scans such configurations and flags these risks, providing prioritized findings with severity and remediation guidance. Without proper header normalization and request boundary enforcement, the combination of Chi and Cockroachdb can unintentionally expose a backend to data exposure or unauthorized operations.

To mitigate request smuggling in Chi while using Cockroachdb, ensure strict header handling and request boundary enforcement at the application layer. The goal is to make Chi’s request parsing consistent with the proxy’s behavior, and to avoid relying on potentially manipulated headers for authorization or routing decisions.

1. Normalize request headers before routing

Strip or reject ambiguous headers such as Transfer-Encoding when not needed, and enforce Content-Length for request bodies. This prevents Chi from interpreting a smuggled chunked body.

(ns myapp.middleware
  (:require [ring.middleware.content-length :refer [wrap-content-length]]))

(defn strip-smuggling-headers [handler]
  (fn [request]
    (let [headers (:headers request)
          ;; Remove Transfer-Encoding if present to avoid chunked smuggling
          cleaned-headers (dissoc headers "transfer-encoding")
          ;; Ensure Content-Length is present for body parsing consistency
          request' (assoc request :headers cleaned-headers)]
      (handler request'))))

(def app
  (-> handler
      strip-smuggling-headers
      wrap-content-length))

2. Enforce strict authorization after request reconstruction

After ensuring headers are normalized, re-derive authorization from authenticated session data stored in Cockroachdb rather than from request metadata. Use a session lookup that validates the subject against the database for every request.

(ns myapp.db
  (:require [next.jdbc :as jdbc]))

(defn get-user-by-session [db session-id]
  (first (jdbc/execute! db
    ["SELECT id, role FROM users WHERE session_id = ? AND revoked = false" session-id])))

(defn authorized? [request required-role]
  (if-let [user (get-user-by-session (:db request) (:session-id request))]
    (= (:role user) required-role)
    false))

(defn protected-route [request]
  (if (authorized? request :admin)
    {:status 200 :body "Admin area"}
    {:status 403 :body "Forbidden"}))

3. Use consistent request size and body handling

Limit request body size and avoid streaming large or ambiguous bodies when not necessary. This reduces the surface for smuggling via chunked encoding and ensures Cockroachdb-bound transactions remain predictable.

(ns myapp.config
  (:require [ring.middleware.body-params :refer [wrap-body-params]]
            [ring.middleware.json :refer [wrap-json-body]]))

(def app
  (-> handler
      (wrap-body-params {:limit 8192})
      wrap-json-body
      strip-smuggling-headers
      wrap-content-length))

By combining these patterns—header normalization, strict session validation against Cockroachdb, and bounded body parsing—you reduce the risk of request smuggling. middleBrick’s scans can help identify inconsistencies between proxy and application behavior, and its GitHub Action can enforce security checks in CI/CD before deployment.