Re: lynx-dev "Alert!: HTTP/1.1 400 Bad Request"

[Ian Collier]

On Tue, Feb 05, 2002 at 11:11:13PM +0000, David Woolley wrote:
> >   Your browser sent a request that this server could not understand.  
> >   Client sent malformed Host header  

> I don't really have much sympathy with this problem as the URL is 
> deliberately designed to mislead filtering software; it is a typical
> spammer's trick.

True, although there are legitimate uses for these kinds of URL.

> However, I think one can reasonably assume that Lynx is sending everything
> between // and the first single / to one of:

> - the user's proxy;
> - the microsoft server;
> - the offender's server at 212.254.206.213.

It's the latter.  A trace shows that Lynx connects to 212.254.206.213
and then sends an HTTP request with "Host: address@hidden".

Here we have semi-transparent web proxying which uses the Host: header
to find out where the request was meant to be going, so it's this proxy
which sends back a 400.  In other cases, the request is sent direct to
212.254.206.213 and it's that server which returns the 400.

imc

; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to address@hidden