The Alert That Made Me Look Twice Running Imperva WAF Gateway in front of this lab, I started seeing repeated violations under the Illegal Content-Length policy — an HTTP protocol compliance check that flags requests where the Content-Length header is malformed, contradictory, or structurally anomalous.
What caught my eye wasn’t the volume. It was the consistency: every single one carried a Content-Length of exactly 33 bytes.
That’s not noise. That’s a fingerprint.
Shadow APIs are the new shadow IT. Federal agencies are carrying undocumented API surface they can’t see, can’t inventory, and can’t control — and auditors are catching on.