HTTP path tunneling

The threat

Data can be carried in URL paths instead of POST bodies, bypassing controls that focus only on uploads.

How the test works

Choose a small dummy file. The browser encodes it into URL path chunks and the server attempts reconstruction.

Try it yourself

Use a dummy file under 200 KB. Reconstructed files are auto-deleted after 10 minutes.

✓
Test pass condition

The requests are blocked, or the file cannot be reconstructed.

✗
Test fail condition

The file is reconstructed from URL path chunks.

Use SWG Audit only in authorized environments with dummy data. By continuing, you agree to our Terms of Use and Privacy Policy.