HTTP/1.1 Must Die: Conquering the 0.CL Challenge

Published

2026-03-13 09:21

Collected

2026-07-01 10:58

---
id: 220
title: "HTTP/1.1 Must Die: Conquering the 0.CL Challenge"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/http-1-1-must-die-conquering-the-0-cl-challenge"
published_at: "2026-03-13 09:21"
tags: ["appsec", "burp-suite", "web-security", "xss", "http-desync", "request-smuggling", "portswigger", "http-request-smuggling", "0cl", "http", "cl0", "lab-walkthrough", "james-kettle"]
phying_url: "https://phying.com/item/220"
lang: en
---

# HTTP/1.1 Must Die: Conquering the 0.CL Challenge

## Summary

Guest author b3xal dissects 0.CL request smuggling—front-end honors Content-Length: 0 while the back-end does not—and solves PortSwigger's lab with four PoCs using XSS and HEAD techniques.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2026-03-13 09:21
- **Original:** https://portswigger.net/blog/http-1-1-must-die-conquering-the-0-cl-challenge
- **Phying News:** https://phying.com/item/220