In my server log, I found at least one IP address to be requesting a full URL in an awkward place. For example, the header the client sends to my server is this:
GET http://www.3rdpartysite.com/file.php HTTP/1.1
And here, I'm expecting request headers to be more like this:
GET /path/to/file.php HTTP/1.1 Host: example.com
This makes me think hackers are trying to break my website, but then I look here at http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html and it talks about that first GET request being valid for proxies.
My server has cpanel and whm installed but I don't use proxies for my website. My question then is, if I force apache to return an error or redirect to all HTTP request headers beginning with...
...and I request remote systems to issue headers in this format....
GET /path/to/resource HTTP/x.x Host: example.com
would my idea work with all web browsers? or would at least one legit web browser break?
I just have a feeling some hacker is using my server to connect to another.