How to deal with BAD request like: curl -i -X "\03\00" http://127.0.0.1:8080/

272 views
Skip to first unread message

James LIAOHJ

unread,
Sep 24, 2021, 5:01:51 AM9/24/21
to openresty-en
when I test such a request to my openresty server 1.19.9.1 on ubuntu facol,  I got the reply:

HTTP/1.1 400 Bad Request
Server: openresty
Date: Fri, 24 Sep 2021 07:01:05 GMT
Content-Type: text/html; charset=utf8
Content-Length: 154
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>openresty</center>
</body>
</html>

the problem is :

1,  my lua code cannot get this request.  is there andy item in /usr/local/openresty/nginx/conf/nginx.conf can make lua code be aware  of this kind of request.  so we can block the client ip by lua.

2,  if we cannot do no.1,  can we hide the message "openresty" at both http header and http body?  I have try  "server_tokens off;"  but it worked only when a normal request , not function at the "\0x03\0x00" like requests.

thanks for any tips .

James LIAOHJ

unread,
Sep 25, 2021, 3:30:49 AM9/25/21
to openresty-en
The result is our LUA code can catch such BAD request,  the cause is about the nginx.conf.

when config like follow , it will cause error and emit an 500 ERROR.

```
# this type of config wont work， lua will not been execute
error_page 400 404 403 405 @Catch404;
# next line also can wont work
#error_page 400 404 403 405 = @Catch404;

location @Catch404 {
    rewrite_by_lua_file /path/to/somefile.lua
    content_by_lua_block {
        ngx.say("...")
    }
}

```
the error.log shows: `empty URI in redirect to named location "@Catch404" while reading client request line`,  it maybe a problem of nginx.


the config can make LUA code been executed is following:

```

error_page 400 404 403 405  /Catch404;

location /Catch404 {
    rewrite_by_lua_file /path/to/somefile.lua
    content_by_lua_block {
        ngx.say("...")
    }
}

```


thanks ! 
Reply all
Reply to author
Forward
0 new messages