2

I am running a website on AWS EC2 instance. I am logging http requests headers. When I checked the logs, I noticed that there are many requests from the AWS EC2 instance public ip.

Example:-

AWS EC2 public ip : 1.2.3.4

{"headers":{"host":"1.2.3.4:80"}}

Is it possible to have server sending http request to itself for viewing web pages?

I am logging each request and the url they are requested.

I tested and logged the files locally by creating a local server but there were no requests from server to itself or something like this.

I am new here, help me with some explanation. Is it a security threat? If it is, How it can be resolved?

4

That is not the source IP of the request, it's the value of what the user agent set in the Host header.

When I make a HTTP request to StackExchange to fetch this question page, it looks like this:

GET /questions/169836/http-requests-from-server-itself HTTP/1.1
Host: security.stackexchange.com
...

The Host header indicates that I wish to load from the security.stackexchange.com host, and is usually automatically filled by my browser when I make a request. It knows the host because it's in the full URL I'm visiting.

The header allows one server to host multiple sites on multiple domains via virtual hosting. One HTTP server on one IP address can host multiple sites with different domain names (each pointing to the same IP via DNS) differentiated by the content of the Host header sent by the user agent (e.g. a browser).

What you're seeing is either requests someone made manually by going to http://1.2.3.4 or requests made by automated systems that scan the internet. In the case of the latter, they likely scan by IP space only and do not know the correct hostname for the system, so simply provide a Host header with the IP address in.

In summary: these requests are not being made from your own webserver, and I would not say this is a security concern.

  • oh thnx alot.. 1 more question if you can help... Sometimes i even have empty headers ... like Headers:{} and sometimes there are no host or user-agent property...sometimes just "accept" property... is it safe too? Any way i can check the source of the request? – Himanshu Bansal Sep 20 '17 at 13:07
  • @HimanshuBansal Chances are these are just random bits of traffic from the internet from various indexers, scanners, etc. The internet is a noisy place. If you're concerned, consider setting up mod_security or whatever the equivalent WAF is for your server application. – Polynomial Sep 20 '17 at 13:08
  • Thnx i'll look into it. – Himanshu Bansal Sep 21 '17 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.