1

We have a user making a POST to our webserver (windows server 2003, IIS 6). They get the full response from our webapp, but then IIS also responds with a "400 Bad Request". No other information is provided (yes I have friendly errors turned off).

At first, I thought maybe it was some middleware injecting a response in there. However, I was able to find the following in the HTTPSys error logs which confirms that it is coming from our server:

2013-08-09 23:36:40 11901 80 HTTP/0.0 Unparsed - 400 - BadRequest -

There are a whole slew of these errors piling up, and I have no idea why. Unparsed doesn't really tell me anything, so I don't have much to go on. I was able to get them to produce a wireshark trace, which shows that we are indeed responding with the full correct response and then appending a 400 bad request response. I copied their request EXACTLY from wireshark and tried it from my machine and of course, I can't reproduce it (I get the one valid response back).

So I am completely unable to reproduce the "Unparsed" error, I WAS however able to get two responses back from one request. I intentionally broke the line endings between the request headers and body and I got back a full correct response followed by "Bad Request (Invalid Verb)".

Two questions

1) Does anyone have any ideas as to how to produce an "Unparsed" error in HTTPsys logs? Any thoughts on how I might go about reproducing this?

2) WHY is IIS responding to a single request with two responses? Is that normal behavior, or indicative of a configuration error?

Thanks for anyone willing to offer help on this terrible headache!

4

1 回答 1

1

将在这里回答我自己的问题，因为我不希望其他人遭受这种痛苦。

原来他们的 POST 在内容长度上有一个小错误，我认为它不包括最后的“\r\n”，但不管它是什么，计数最终都少了 2。

当我复制确切的请求并从我的机器发送它时，这从未出现的原因是我没有正确关闭连接。出于某种原因，使用 FIN 关闭连接实际上会产生影响并导致 400 Bad Request。

不知道为什么会发生这种情况，也许在 FIN 到来时以某种方式读取了初始请求中发送的额外字符？我不知道，但你有它。修复内容长度，痛苦就消失了。

于 2013-08-14T20:08:26.673 回答