The clue here is where you say you received a duplicate GET
request. The rest of your question almost put me off course, thinking some client (or another server on its behalf for whatever reasons) duplicated POST
requests, or even duplicated complete request headers (cookies, e.t.c.). But what you describe could as well be read as "same URL was requested".
Anyway, the most common reason for duplicate GET
requests come from what are known as caching proxies. Some such products can be detected by seemingly lacking any support for compression (gzip
, deflate
,...) showing in your logs as duplicate requests but the response size will be larger, such as Blue Coat System's ProxySG (apparently one of the largest players in the proxy appliance business). Others might change User Agent
string accordingly to identify themselves to web admins reading access logs, Web Application Firewalls, e.t.c, and some repeat requests completely synonymously to original requests, and only the IP address
might differ, if even (if the client uses the proxy also as gateway, then the IP address
will remain exactly the same, and repeated requests will follow the cache expiration headers of requested contents).
These caching proxies
can be a bit obnoxious at times (see for example this ranting on Blue Coat System's solutions), but they aren't considered as any particular security threat. Well, at least not any differently than with all other proxies - at the end of the day, they are Men in The Middle and untrusted hosts can be considered extremely risky to use to the end users. But a lot of networks do use them for various reasons, such as local caching to reduce bandwidth needs to remote hosts, speed up response times, even cache multiple old copies of accessed documents for accessibility. And in a sense, Google is the biggest proxy we know of. What I'm saying is there is no indication the request you describe was duplicated with any malicious intentions, and such request duplications shouldn't cause any problems on your server end (besides an occasional unnecessary bandwidth hogging), if your web applications are written properly, to re-authorize users whenever necessary, and use other means of identifying individual users than GET
request's URI
parameters (such as cookies
, that non-malicious caching proxies shouldn't attach to their duplicate requests for caching purposes).
I'm not saying what happened wasn't a malicious attempt, what I'm saying is what you describe doesn't prove it either way, and it could as well have been a benign visitor of the caching proxy variety.