In our server logs, we see that some HTTP requests contain the parameter
bmi_MfsTid=<number>. We are not using this parameter. Is there a known client or proxy that appends this?
I'm seeing this when using the UK mobile network, EE, with HTTP requests that result in a 302 Redirect. The resulting Location header in the response contains the
bmi_MfsTid parameter on the query string.
I tracked this down to requests that include a
Range: HTTP header and an iOS User Agent such as:
Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A356 Safari/604.1 AppleCoreMedia/126.96.36.199E227 (iPhone; U; CPU OS 12_2 like Mac OS X; en_gb)
Obviously, something on the mobile network is injecting the
bmi_MfsTid for some reason. I'm not sure if it's relevant, but EE is a pure IPv6 network that uses DNS64 and NAT64, so it's possible it's the NAT64 proxy is adding this header.
- Remove the Range header.
- Or: Alter the User Agent to a non-Apple one
- Or: Change request to HTTPS so that EE is unable to see and change the body