0

I noticed weird log entries (unless there's something i don't understand) in my IIS (7.5) logs.

it's an online dictionary with requests ( user friendly url rewriting ) and most of them are GET. However I noticed weird POST requests which are taking place by a person who is trying to crawl our content ( tens of thousands of such requests )

2013-11-09 20:39:27 GET /dict/mylang/word1 - y.y.y.y Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html) - 200 296
2013-11-09 20:39:29 GET /dict/mylang/word2 - z.z.z.z Mozilla/5.0+(iPhone;+CPU+iPhone+OS+6_0+like+Mac+OS+X)+AppleWebKit/536.26+(KHTML,+like+Gecko)+Version/6.0+Mobile/10A5376e+Safari/8536.25+(compatible;+Googlebot-Mobile/2.1;++http://www.google.com/bot.html) - 200 468

2013-11-09 20:39:29 POST /dict/mylang/word3 - x.x.x.x - - 200 2593

The two first requests are legal. Now for the third request, I don't think I have allowed cross domain POST. if that what the third log line means.

all those POST requests take that much time for unknown reasons to me. I would like to know how are those POST requests possible and how can I stop them.

p.s. I have masked the IPs on purpose.

any help would be appreciated! thank you in advance.

  • Do you need the POST verb for other calls? If the server is single purpose and you don't, check out: iis.net/configreference/system.webserver/security/… – dtryon Nov 10 '13 at 0:41
  • yes, POST is needed because of AJAX calls to other files not shown here. Can you tell me how it is possible for someone to make an ajax call like that in the log ? – MirrorMirror Nov 10 '13 at 1:21
1

I'm not sure what you mean with 'cross domain post'. Also the post in the log does not have to be an AJAX request.

By default an resource on your site can be requested with various http verbs. Just because GET is used most often, there is nothing to prevent a client from using a POST when requesting the resource. That's what you see in the log.

Assuming you are using a modern IIS (7+) you can specify which verbs are allowed on a site, directory or file basis.

You are saying you are using some sort of routing, so you may not have directories or files, you can still set the allowed verbs, in your web.config add something like the following under the configuration root:

<location path="dict/mylang">
<system.webServer>
    <security>
        <requestFiltering>
            <verbs>
                <add verb="POST" allowed="false" />
            </verbs>
        </requestFiltering>
    </security>
</system.webServer>

In the location node you are telling IIS to just apply this for a specific URL, then you just say, don't allow any POST requests here. This is not possible in the IIS GUI.

Also you will still get entries in your log files, but they will be 404s with a sub-status of 6 (Verb denied) and they shouldn't take that long.

| improve this answer | |
  • Thank you for the answer. I will see if what you suggest will work, because under dict/mylang/ i have .php files which are indeed called through ajax requests via POST so I will have to move them elsewhere. Do you have any wild idea why those requests by this guy take so long ? they are anywhere from 2.5 to 4 seconds. Can it be because right now he is using proxies in Asia ( korea, japan etc.) ? or does it mean my IIS takes that long to process it ? – MirrorMirror Nov 10 '13 at 12:37
  • 1
    You could try to set a url in location path that only matches requests that don't allow Post, so you can keep the php files in the same directory. I'm not sure why those request take so long. Maybe he post a megabyte of junk in his request and IIS takes time to process that. – Peter Hahndorf Nov 10 '13 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.