Http Request Smuggling in Django with Basic Auth

Http Request Smuggling can occur in Django when an application processes requests that contain both HTTP/1.1 hop-by-hop headers and Basic Auth credentials in a way that causes front-end and back-end parsers to disagree on request boundaries. This is especially risky when Basic Auth is used, because the Authorization header is often treated as trusted or static, which may reduce strict validation of message framing. A common pattern is a Django app behind a load balancer or reverse proxy that handles Authorization and passes the request to an upstream server.

In practice, smuggling can be triggered by sending a request that mixes Content-Length and Transfer-Encoding (or uses ambiguous chunked syntax) while including a Basic Auth header. For example, an attacker may send two requests combined in one TCP stream: the first request uses Content-Length to declare a small body but includes a second request in the body, while the second request uses Transfer-Encoding: chunked. If the front-end parses one boundary and the back-end parses another, the second request may be interpreted as part of the next user’s request, bypassing intended scoping of credentials.

Because Basic Auth sends credentials in an Authorization header (base64-encoded, not encrypted), smuggling can expose authentication context across requests. Consider this malicious combined request (shown conceptually; actual smuggling requires precise byte alignment and depends on infrastructure behavior):

POST /target HTTP/1.1
Host: example.com
Content-Length: 38
Authorization: Basic dXNlcjpwYXNz
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: example.com
Authorization: Basic dXNlcjpwYXNz

If the front-end strips or misinterprets Transfer-Encoding and the back-end respects it, the second request may be routed without proper credentials checks, effectively allowing an attacker to piggyback on another user’s authenticated session. Django’s built-in development server is not designed for production proxying, but in production setups with proxies, incorrect configuration can amplify these risks. The presence of Basic Auth does not cause smuggling by itself, but it can make post-smuggling impact more severe by exposing or misassociating credentials.

To mitigate smuggling when using Basic Auth in Django, focus on strict request parsing, avoiding ambiguous headers, and ensuring your proxy and Django settings align. Do not rely on Basic Auth’s base64 encoding for security; treat it as transparent and always use TLS. Use Django’s built-in authentication views or token-based alternatives where possible, and validate headers explicitly.

First, ensure your proxy (e.g., Nginx, HAProxy) normalizes or rejects suspicious hop-by-hop headers and does not forward ambiguous framing to Django. Configure your proxy to handle Content-Length and Transfer-Encoding consistently and to close connections when smuggling indicators are detected. Then enforce strict header handling in Django settings and views.

Example: A Django view that explicitly rejects requests with Transfer-Encoding and validates Content-Length before processing Basic Auth credentials:

import base64
from django.http import HttpResponse, HttpResponseForbidden
from django.views.decorators.http import require_http_methods
def validate_basic_auth(request):
    auth = request.META.get('HTTP_AUTHORIZATION', '')
    if not auth.lower().startswith('basic '):
        return HttpResponseForbidden('Missing Authorization')
    try:
        encoded = auth.split(' ', 1)[1].strip()
        decoded = base64.b64decode(encoded).decode('utf-8')
        username, _, password = decoded.partition(':')
        # Replace with your user validation logic
        if username == 'admin' and password == 'secret':
            return HttpResponse('Authenticated')
        return HttpResponseForbidden('Invalid credentials')
    except Exception:
        return HttpResponseForbidden('Bad Authorization header')
@require_http_methods(['GET', 'POST'])
def my_view(request):
    # Reject ambiguous transfer coding before auth processing
    if request.META.get('HTTP_TRANSFER_ENCODING', '').lower() == 'chunked':
        return HttpResponseForbidden('Transfer-Encoding not allowed')
    return validate_basic_auth(request)

In production, use a robust WSGI server and a security-hardened reverse proxy. Configure the proxy to strip any incoming Transfer-Encoding headers and to normalize Content-Length before passing requests to Django. Additionally, prefer session-based or token-based authentication over Basic Auth to reduce exposure of credentials and to simplify secure session management. Regularly test your deployment with tools that specialize in protocol-level boundary issues, and monitor for unexpected request routing or authentication bypass indicators.