http requests from server itself

Question

I am running a website on AWS EC2 instance. I am logging http requests headers. When I checked the logs, I noticed that there are many requests from the AWS EC2 instance public ip.

Example:-

AWS EC2 public ip : 1.2.3.4

{"headers":{"host":"1.2.3.4:80"}}

Is it possible to have server sending http request to itself for viewing web pages?

I am logging each request and the url they are requested.

I tested and logged the files locally by creating a local server but there were no requests from server to itself or something like this.

I am new here, help me with some explanation. Is it a security threat? If it is, How it can be resolved?

Answer 1

That is not the source IP of the request, it's the value of what the user agent set in the Host header.

When I make a HTTP request to StackExchange to fetch this question page, it looks like this:

GET /questions/169836/http-requests-from-server-itself HTTP/1.1
Host: security.stackexchange.com
...

The Host header indicates that I wish to load from the security.stackexchange.com host, and is usually automatically filled by my browser when I make a request. It knows the host because it's in the full URL I'm visiting.

The header allows one server to host multiple sites on multiple domains via virtual hosting. One HTTP server on one IP address can host multiple sites with different domain names (each pointing to the same IP via DNS) differentiated by the content of the Host header sent by the user agent (e.g. a browser).

What you're seeing is either requests someone made manually by going to http://1.2.3.4 or requests made by automated systems that scan the internet. In the case of the latter, they likely scan by IP space only and do not know the correct hostname for the system, so simply provide a Host header with the IP address in.

In summary: these requests are not being made from your own webserver, and I would not say this is a security concern.