cyberExploring Client-Side Desync: Understanding the Risk and Mitigating the Threat

What is Client-Side Desync?

Client-side desync occurs when there is a mismatch or discrepancy between how the client (usually a web browser) and the server interpret the boundaries of an HTTP request. Unlike server-side desynchronization, where discrepancies happen between different servers in the infrastructure (such as a front-end and back-end server), client-side desync occurs between the client and the server.

These desync attacks often result in the manipulation of HTTP requests, leading to unexpected behaviors such as:

The critical vulnerability arises when the web client and server disagree on the exact point where one HTTP request ends and another begins. This allows an attacker to “desynchronize” the communication between the client and server, sending malicious data that leads to a variety of attacks.

How Does Client-Side Desync Work?