Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I run a website, let's say www.example.com. On it I have a path and file, say www.example.com/path/file.html.

The Apache log lists GET requests like: GET /path/file.html HTTP/1.1

Which is correct, corresponding to www.example.com/path/file.html; such lines result in a 200 status code and everything's good.

But then I have other entries:

GET http://www.example.com/path/file.html HTTP/1.1

or

GET http://www.othersite.net/ HTTP/1.1

Which would correspond to something like http://www.example.com/http://www.example.com/path/file.html or http://www.example.com/http://www.othersite.net/ which does not exist (My server returns a 404 for these.).

These requests are always from far away (Italy, Latvia, ...) while actual users of my website are invariably local. What are these? Is there any particular reason for these requests? Have others seen these happen?

It's been going on for at least a year and it's continuous (though I'm not being flooded).

They are not transparent attacks such as:

GET //mysql-admin/ HTTP/1.1 or GET /webdav/test HTTP/1.1

share|improve this question
    
Are there links to othersite.net on your site? –  paulmorriss Aug 11 '11 at 14:35
    
@paulmorriss: No, I've never seen it before. Also there are several sites that come up like that. I see hotlinked images, blog links, and the like. –  Charles Aug 11 '11 at 14:53
    
Most likely 1) those requests were sent by bots that were given bad URLs in first place .. or did not parsed given URLs properly or 2) those are the actual badly created links somewhere there and those were users clicking on it: some browsers can "fix" them, but most will not. –  LazyOne Aug 11 '11 at 15:19
add comment

1 Answer

up vote 3 down vote accepted
GET http://www.example.com/path/file.html HTTP/1.1
GET http://www.othersite.net/ HTTP/1.1

These are attempts to use your server as a HTTP proxy; that's what a full URL rather than a path in the request means. These are attempts to misuse your server as an open proxy, which it is properly rejecting.

Giving the full URL while requesting a page from your own site may also be the result of broken HTTP clients.

Don't worry about it as long as you have 4xx responses in your logs.

share|improve this answer
    
Ah, I guess this means I don't know HTTP. :x –  Charles Aug 12 '11 at 1:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.