I've noticed some of these lines in my error log (apache2):
Invalid method in request var1=1&var2%5B%5D=5915&var3=1GET /path/name.pdf HTTP/1.1, referer: http://www.domein.tld/path/morepath
For some reason this request gets made (multiple times by different users, but the strange request is always build-up the same way). The first part of the 'request' seems to be a part of an
AJAX request a certain page does (only the vars, not the URL), concatenated with a valid
GET request for a file (pdf).
As you can see the request does NOT start with a method (
POST), but does have one halfway. I can't figure how you would get this from a programming error in the page itself, so I suspect something more lowlevel (e.g. apache or client-side (browser?)) (but correct me if I'm wrong on that).
Ofcourse, the "method halfway" could be simply an error-log fail, but the error itself is consistent with it: no-method sounds like an invalid one to me :).
Obviously I'm really curious about how this happens, and how to avoid id.
The problem only occurs a couple of times per day, while that page is called a lot, so it's not happening every time (not by far).
For a complete overview a part of the access-log of that ip/moment, but it's no big help as far as I can see (the lines are obviously anonymised, the line below the POST is the same as the one from the errorlog, i've left some more stuff intact (like the vars) in the line above)
ip-[date:14:28:26] "GET someimage HTTP/1.1" 304 188 "url" "useragent" ip-[date:14:28:26] "GET somimage2 HTTP/1.1" 304 188 "url" "useragent" ip-[date:14:28:27] "POST someURL HTTP/1.1" 200 51031 "url" "useragent" ip-[date:14:28:59] "ajaxurlpartGET urltopdffile HTTP/1.1" 501 596 "url" "useragent" ip-[date:14:29:03] "GET URL HTTP/1.1" 200 51032 "-" "useragent"
The complete useragent is:
"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.2; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; BRI/2)"
A different example of virtually the same issue had useragent:
"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.2)"
To be clear: I do NOT think this is a programming error, or something that comes from a script. The page does nothing exciting whatsoever, and it would be strange for it to make a low-level http-request and fumbling that. In my mind this is either server-side (apache) or client side (browser, spider, etc.)