Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When my web server is using port 80, a weird query string is appended to any page my visitors go to and breaks some of my services. I changed nginx to use port 81 and it works fine, without the appending of the query string.

The query string looks like this: http://www.site.com/some/url/script.php?COLLCC=2749699728&

There is nothing in my code that would cause this to happen, especially since it only happens on port 80 and regardless of what web server I'm using (Apache, Nginx, etc). Does anyone any idea what could be causing this?

When I do print_r($_SERVER), I get this:

[argv] => Array
    (
        [0] => COLLCC=2693200777&
    )

[argc] => 1

I'm using CentOS 6 64-bit with Nginx + PHP-CGI

share|improve this question
    
Well, something in your code or config has to be doing it. Show the code and config, and someone might be able to figure it out. Otherwise, you'll have to hope that someone reading this question has made exactly the same mistake as you. –  womble Jul 21 '12 at 10:41
    
I've been completely unable to find anything about this COLLCC query string on Google, besides a few Chinese websites that have been affected by the same problem. It(my site) was working without problems earlier today but has since started this behavior at around midnight PST. –  Tar Jul 21 '12 at 10:47
1  
So what changed at around midnight PST? –  womble Jul 21 '12 at 11:53
    
@Tar There's no proxy between the Internet and your web server, right? –  cjc Jul 21 '12 at 13:44
add comment

3 Answers

It could be a stickiness value being added by a load balancer somewhere. It should only be added to the query string if cookies are disabled.

However, the fact that it breaks your code should worry you. Your code should be robust enough to handle this situation. It merely needs to ignore extra query parameters.

You may be able to solve this with a query rewrite to remove the pararmeter. However, this may mask significant problems with your code.

Try accessing the web server from the same host to see if it is an upstream issue. You could use a text browser like lynx or w3m, or tunnel in using ssh so you bypass the network.

share|improve this answer
add comment

As I know, the parameter COLLCC=xxxxx is added in some case of massive DDOS attacks on my webserver by my hoster.

It's only a protection. Which is ugly I admit... But it is required to protect my website when a lot of botnets are targeting my server.

I hope I would help someone. And please excuse me for my bad english, because I'm french.

share|improve this answer
    
I confirm. I wrote to my hoster (shared hosting) about it, they told me they add this value to protect against DDOS attack. They are specialized in this area. Note that this is a very unexpensive hoster, so their method is maybe as cheap as their price. I just still wonder if I can rewrite this url. That's terrible for SEO. –  Léon Pelletier Apr 13 '13 at 0:29
add comment

Could be a mod_rewrite rule specified only for port 80 ... Check your httpd.conf and or any .htaccess files ?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.