What is the difference between HTTP/2 request smuggling and HTTP/2 request tunnelling in practice?

Why This Matters for Security Teams

HTTP/2 request smuggling and HTTP/2 request tunnelling both exploit desynchronisation, but they create different operational risks. Smuggling is dangerous because a crafted request can influence another user’s traffic on a shared back-end connection. Tunnelling is subtler: the attacker can often send complete hidden requests that traverse a path the front end does not reuse, so impact may be limited to the attacker while still proving a control gap. For defenders, the distinction matters because detection, logging, and blast radius are not the same. This is especially relevant when HTTP/2 is terminated at a proxy or gateway that translates to HTTP/1.1 or another internal protocol. The boundary between front-end parsing and back-end forwarding becomes the fault line, and that is where desync bugs emerge. NIST’s control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it reinforces disciplined boundary protection and monitoring, but it does not remove the protocol ambiguity by itself. The practical lesson is that transport-layer correctness has to be validated, not assumed. NHI Management Group has also documented how often identity and access sprawl creates hidden exposure; only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs — What are Non-Human Identities. In practice, many security teams encounter desync only after unusual proxy behaviour or a downstream incident has already made the gap visible, rather than through intentional validation.

How It Works in Practice

At a technical level, both issues depend on disagreement about where one request ends and the next begins. In HTTP/2, attackers may exploit inconsistent handling of pseudo-headers, stream state, or translation to HTTP/1.1 at the edge. The difference is in what happens after the desync:

• With request smuggling, the attacker causes one request to be interpreted as part of another user’s request or connection context.
• With request tunnelling, the attacker often uses the mismatch to carry a complete hidden request that the front end does not visibly process in the same way.
• Smuggling usually creates a shared-blast-radius problem, while tunnelling can produce attacker-only observations that still prove parser inconsistency.

Defenders should compare front-end and back-end request parsing paths, especially where a CDN, reverse proxy, load balancer, or web application firewall terminates HTTP/2 and forwards legacy traffic. The key control is not just blocking a single payload pattern. It is making parser behaviour deterministic across the full chain, then verifying that with targeted test cases and high-fidelity logs. OWASP guidance on request desync testing and NIST control expectations on monitoring both support this approach, but current guidance suggests there is no universal “one check” that proves safety across all intermediaries. The Ultimate Guide to NHIs — What are Non-Human Identities is relevant because many desync paths are exposed through service-to-service traffic, not just browser traffic. Pair that with the NIST SP 800-53 Rev 5 Security and Privacy Controls emphasis on auditability, and the operational lesson is clear: you need repeatable evidence that front-end and back-end interpretations match. These controls tend to break down when multiple intermediaries normalise HTTP differently because the same payload can be accepted, split, or replayed in inconsistent ways.

Common Variations and Edge Cases

Tighter protocol validation often increases testing and tuning overhead, requiring organisations to balance compatibility against security assurance. That tradeoff becomes sharper in mixed estates where HTTP/2, HTTP/1.1, gRPC, and proprietary gateways coexist. Best practice is evolving, and there is no universal standard for this yet, especially when vendors implement partial RFC support or custom translation layers. A common edge case is “successful” tunnelling that does not immediately affect another victim. Teams sometimes dismiss it because the visible impact seems low, but it still proves a desync condition that may be exploitable later in a different topology. Another edge case is infrastructure that normalises requests differently on idle vs busy connections, which can make lab findings hard to reproduce in production. That is why confirmation should rely on controlled differential testing, not a single positive response. The Ultimate Guide to NHIs — What are Non-Human Identities is useful here as a reminder that hidden service traffic is often where these flaws persist longest.

Related resources from NHI Mgmt Group

• What is the difference between network trust and request-level identity trust?
• What is the difference between access request automation and access governance?
• What is the difference between birthright access and request-based access?
• What is the difference between two-factor authentication and MFA in practice?