I've recently noticed a number of errors in our sites' error logs which are a result of what appears to be a cache-buster being incorrectly added to URLs.
The requests in question all seem to have "?rand=0.nnnnnnnnnnnnnnnnn" on the end of the URL, with 0.nnnnnnnnnnnnnnnnn being a random number between 0 and 1.
However, this is appended without regard for whether the URL already has querystring parameters, so for example
Thus causing the
page querystring parameter to be "1?rand=0.37218398530967534", not a valid integer.
What I've noticed:
- All of these requests from from Chrome user agents (Windows and Mac, versions ranging from Chrome 35 to Chrome 39)
- Many of the requests are from logged-in users (our error logger records cookies) so it's not broken spiders
- Sometimes there are multiple requests in quick succession, from the same logged-in user, but from different IP addresses. e.g. one example had a hit from 59.95.54.x (an ISP in India) followed one second later by a hit from 162.243.129.x (Digital Ocean, a US cloud hosting company) for the same URL - same random number! - from the same user.
I wonder if it might possibly be some buggy and misbehaving cache-buster extension for Chrome? Although the hits from other IP addresses are odd.
Edit: Craig Hyatt suggested that perhaps the hola.org plugin might be implicated. I took a look at it, and can confirm that it did use a Digital Ocean IP addresses as a proxy when I selected to browse from the USA. Also, looking at the comments on its Chrome extension page, someone said "Your addition of ?rand=*** causes websites that use URL variables to show errors." I looked through the code and couldn't find anything that would do this - but it was just updated yesterday. Possibly a bug that is already fixed?
Further Edit: I was able to confirm that one of the users who has had this error logged is using the hola.org plugin. She will uninstall it and I will monitor whether the error recurs. Also I have emailed Hola support to ask if this is a known issue.