Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've noticed some of these lines in my error log (apache2):

Invalid method in request var1=1&var2%5B%5D=5915&var3=1GET /path/name.pdf HTTP/1.1, referer: http://www.domein.tld/path/morepath

For some reason this request gets made (multiple times by different users, but the strange request is always build-up the same way). The first part of the 'request' seems to be a part of an AJAX request a certain page does (only the vars, not the URL), concatenated with a valid GET request for a file (pdf).

As you can see the request does NOT start with a method (GET, POST), but does have one halfway. I can't figure how you would get this from a programming error in the page itself, so I suspect something more lowlevel (e.g. apache or client-side (browser?)) (but correct me if I'm wrong on that).

Ofcourse, the "method halfway" could be simply an error-log fail, but the error itself is consistent with it: no-method sounds like an invalid one to me :).

Obviously I'm really curious about how this happens, and how to avoid id.

The problem only occurs a couple of times per day, while that page is called a lot, so it's not happening every time (not by far).

For a complete overview a part of the access-log of that ip/moment, but it's no big help as far as I can see (the lines are obviously anonymised, the line below the POST is the same as the one from the errorlog, i've left some more stuff intact (like the vars) in the line above)

ip-[date:14:28:26] "GET someimage HTTP/1.1" 304 188 "url" "useragent"
ip-[date:14:28:26] "GET somimage2 HTTP/1.1" 304 188 "url" "useragent"
ip-[date:14:28:27] "POST someURL HTTP/1.1" 200 51031 "url" "useragent"
ip-[date:14:28:59] "ajaxurlpartGET urltopdffile HTTP/1.1" 501 596 "url" "useragent"
ip-[date:14:29:03] "GET URL HTTP/1.1" 200 51032 "-" "useragent"

The complete useragent is:

"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.2; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; BRI/2)"

A different example of virtually the same issue had useragent:

 "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.2)"

To be clear: I do NOT think this is a programming error, or something that comes from a script. The page does nothing exciting whatsoever, and it would be strange for it to make a low-level http-request and fumbling that. In my mind this is either server-side (apache) or client side (browser, spider, etc.)

share|improve this question
    
I don't think apache is responsible for this. It seems to me as programming bug or client fault. –  Khaled Feb 3 '12 at 14:53
    
Ofcourse, I didn't put "client fault" in there, my bad. Could you explain "programming bug" ? A simple site (html/javascript) shouldn't be interfering with request methods etc, should it? –  Nanne Feb 3 '12 at 14:57
    
Normally, it should not. However, this can occur if you are dealing with some lower-level calls. –  Khaled Feb 3 '12 at 15:03
    
Nothing fancy is happening. Some jQuery is as 'low' as the page goes –  Nanne Feb 3 '12 at 15:32
    
Are you sure that it's your JavaScript (and not some random buggy scraper/spider/bot) that's sending these requests? Do the IP addresses and timestamps line up with that JavaScript being sent out to them earlier? –  Thomas Feb 3 '12 at 19:06
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.