processone / ejabberd-contrib

Growing and curated ejabberd contributions repository - PR or ask to join !
http://ejabberd.im
248 stars 137 forks source link

http-auth server get request with "empty user" #258

Open adiii717 opened 5 years ago

adiii717 commented 5 years ago

There is no client connect with ejabberd server but we are getting a false request in our HTTP-auth server.

We have a check on a user, and a user is not allowed to log in with empty password and username is by default but we notice these logs.

Here are the complete logs of HTTP-auth server which is getting empty user and the password.

{"level":"error","timestamp":1536545024,"method":"GET","url":"http://localhost:3000/check_password?user=&server=home-portal&pass=","user_ip":"::ffff:127.0.0.1","message":"user is empty.","baseUrl":"","status":400,"errorCode":1002,"mac":""}

When we log the request we are getting this URL. http://localhost:3000/check_password?user=&server=home-portal&pass=

This is not frequent behavior but occur 5 to 10 time in 24 hours. Ejabberd version is 18.04