0

On an apache server with a standard setup, when I request a URL in the form of:

http://127.0.0.1/..

I receive this error in my log:

[Sun Aug 30 22:52:44 2015] [error] [client 127.0.0.1] Invalid URI in request GET /.. HTTP/1.1

and HTTP status 400 is returned from apache stating "Your browser sent a request that this server could not understand."

Other servers seem to handle the same type of URL differently.

When I request:

http://stackoverflow.com/..

I receive an access denied message (server status 403).

When I request one of these:

http://google.ca/..
http://google.com/..

I receive a temporary redirect to the same URLs without the trailing dots.

I tested everything with CURL.

So my question is what is the proper way to handle a request like this?

  • Not sure why you are asking. You should no ever see a request like this unless you are being attacked by a hacker. – closetnoc Aug 31 '15 at 3:08
  • 1
    I am because I'm configuring my web server to not accept duplicate content and I'm not sure the proper way to handle this request. – Mike Aug 31 '15 at 3:24
  • I block these kinds of requests normally. It something akin to cd .. and therefore normally inappropriate. They often come (for me anyway) as a result of trying to gain access to a file by a hacker. If you want to do something with these requests, I would think that just dropping any .. or ../ and seeing if there is any sense in the request at all- if so then show the page, if not then 404 or just 404 right away since you want to be sure there is no duplicate content. – closetnoc Aug 31 '15 at 3:40
  • FWIW the browser itself appears to strip the dots from /. and /.. to make a request for /. However, /..., /.... are not touched and requested as is. – MrWhite Aug 31 '15 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.