HTTP request smuggling
hiding one web request inside another so checks miss it
Web traffic often passes through a front device before reaching the server behind it. If the two read the boundaries between requests differently, an attacker can hide a second request inside the first. The front device checks only what it sees. The server behind then acts on the hidden request as if it had been approved.
Think of it as
Slipping a second letter inside an envelope that the mailroom has already checked and stamped.
Ideas that use this term