Request Smuggling in Chi with Basic Auth

Request smuggling occurs when an application processes the same HTTP request differently in the frontend (e.g., a reverse proxy or load balancer) and the backend server. In Chi, when Basic Auth is handled before the request reaches your Chi application, the interaction between the auth layer and Chi’s HTTP handler pipeline can expose smuggling risks if header parsing and request boundary assumptions differ.

Chi is a minimalistic HTTP router for Clojure. When you place Basic Auth at the edge (e.g., via a proxy or within a wrapping handler), the proxy may normalize or interpret headers such as Content-Length and Transfer-Encoding differently than Chi. If the proxy accepts a request with both Content-Length and Transfer-Encoding and forwards it after stripping or modifying one header, Chi may process the body based on the remaining header. This discrepancy can allow an attacker to smuggle a second request inside the first, potentially bypassing intended auth checks for subsequent requests if the proxy assumes auth applies to all requests while Chi does not re-verify for smuggled segments.

For example, a proxy configured to require Basic Auth may strip the Authorization header before forwarding, assuming the backend is trusted. If the proxy normalizes Transfer-Encoding: chunked while also forwarding a Content-Length, and Chi only sees the chunked body, it may parse the request as chunked and leave trailing data that the next request (smuggled) uses. Because Basic Auth was applied once and not re-evaluated per logical request in Chi, the smuggled request may execute without credentials, leading to unauthorized operations.

Using middleBrick to scan an API deployed behind such a setup can help detect mismatched handling of headers and unauthenticated attack surface. The scan’s BOLA/IDOR and Unsafe Consumption checks highlight irregularities in how requests are parsed and whether authorization is consistently enforced across parsed requests.

To mitigate request smuggling when using Basic Auth with Chi, ensure consistent header interpretation and enforce per-request authentication within the application layer. Avoid relying solely on edge-layer stripping or normalization; handle Authorization in Chi so every request is authenticated before processing.

Example: a Chi handler that parses and validates Basic Auth on each request, preventing reliance on upstream normalization.

(ns myapp.core
  (:require [cheshire.core :as json]
            [ring.util.response :as resp]
            [clojure.string :as str]))

(defn parse-basic-auth [header]
  (when header
    (let [[_ user pass] (re-matches #"Basic\s+(\S+)" header)
          decoded (when user
                    (String. (clojure.string/decode-base64 user)))
          [username password] (when decoded
                                (str/split decoded #":"))]
      [username password])))

(defn auth-handler [handler]
  (fn [request]
    (let [auth-header (get-in request [:headers "authorization"])
          [user pass] (parse-basic-auth auth-header)]
      (if (and user pass (valid-credentials? user pass))
        (handler request)
        (-> (resp/response {"error" "unauthorized"})
            (resp/status 401)
            (resp/header "WWW-Authenticate" "Basic realm=\"api\""))))))

(defn valid-credentials? [username pass]
  ;; Replace with secure lookup, e.g., constant-time check against DB
  (and (= username "admin") (= pass "s3cret")))

(def app
  (-> (fn [request]
        (resp/response {"status" "ok"}))
      auth-handler))

Additionally, configure your proxy to avoid mixing Content-Length and Transfer-Encoding. If you must use a proxy, ensure it normalizes requests consistently and does not strip security headers before forwarding. middleBrick’s LLM/AI Security and Input Validation checks can be used to verify that endpoints do not accept ambiguous encodings that could facilitate smuggling.