Re: 400 - Bad requests under II6

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 06/23/04


Date: Tue, 22 Jun 2004 20:38:54 -0700

Ok, this is completely user error. Your client is not sending Host: header,
so fix it. There is nothing wrong with IIS6.

You configured a website on the server to only respond to a certain Host:
header, and then you proceeded to make requests to the server without the
Host: header. Thus, the server rightfully rejects it with a 400 as stated
by HTTP spec.

In other words:
1. by default, the website is listening on port 80 without regard for host
header -- so the first request to port 80 works
2. You changed the default website to listen on port 801, still without host
header -- so any request to port 801 will work
3. You added Host: www.xxx.com , meaning it should only respond to requests
with Host: www.xxx.com -- and then you made a request to it using HTTP/1.0
and without a Host: header. By definition, this is rejected with a 400 Bad
Request since you are requesting a website without a Host: header, and there
is only a website requiring the Host: header www.xxx.com -- there is no
website that is bound to "no hostheader".

I think the problem here is that something is forcing requests to be
HTTP/1.0, which does not enforce Host: headers (a HTTP/1.1 concept). This
is likely a test-environment configuration error. Or, use a flexible client
like WFetch that allows you to control all these HTTP parameters such that
you send valid HTTP requests.

http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Dan@done-that.com" <Dandonethatcom@discussions.microsoft.com> wrote in
message news:B518FED3-A2A7-4A78-8498-B74AB6044198@microsoft.com...
Ok, I went back to the basics,
Removed IIS totaly
Reloaded IIS in Web mode only, it came in with default pages
They ran ok
added one site on an odd port "801" static page only and it ran
changed the port to 80 and added header www.xxx.com
attempt to access www.xxx.com   Bam get 400 error
Logfiles says :
2004-06-21 02:50:00 192.168.0.31 2271 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2272 192.168.0.31 80 HTTP/1.1 POST
/_vti_bin/spscrawl.asmx 400 - Hostname
2004-06-21 02:50:00 192.168.0.31 2280 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2279 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2282 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2281 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2283 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2286 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
2004-06-21 02:50:00 192.168.0.31 2287 192.168.0.31 80 HTTP/1.0 GET
/_vti_bin/help/1033/sps/html/helpresources.htm 400 - Hostname
2004-06-21 02:50:00 192.168.0.31 2288 192.168.0.31 80 HTTP/1.0 GET / 400 -
Hostname
ANy thoughts ?????
"David Wang [Msft]" wrote:
> A 400 Bad Request indicates that the client sent a bad request to the
> server.  Obviously, this can happen for any URL.
>
> 400 Bad Requests will be logged in the HTTPERR.log file along with a
reason.
> Look up the reason and then fix the cause.
>
> For example, maybe you forgot to add the right Host headers to the
> reinstalled websites, so you end up trying to access one website with the
> wrong host headers... and IIS is going to say "what Host: are you asking
> for?  It doesn't exist... so 400 Bad Request".
>
> As for PHP -- the default installation distro requires you to tweak
php.ini
> or else nothing works with errors like you describe.
>
> -- 
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Dan@done-that.com" <Dandonethatcom@discussions.microsoft.com> wrote in
> message news:8D104AF2-C84B-4CD8-B934-FB99A40DA9E5@microsoft.com...
> Ok I lied,
>
> In a desprate attempt to bail out the problem I started to reinstall the
> sites on one of the 2003 Entp Servers. Installed PHP, for the site that
> needed it, and started installing the Static sites (virtuals). It looks
like
> every thng gets 400, except the PHP which complains about cgi settings.
>
> I am missing somthing big, but don't know what it is.. Plus a weekend of
OT
> is starting to wear me down.
>
> What could cause 400's on a static page ????
>
>
> "Dan@done-that.com" wrote:
>
> > Actual I am down to one site,
> >
> > It is a basic PHP based site with a few virtual dir under it.
> >
> > ex:   www.foo.com
> >        www.foo.com/support
> >
> > The support site has no problems but the central site gets a 400, and
> there is no real errors showing up in httmlerr logs. I thought it was a
> security error so I recreated a user to use as the anno. and made sure it
> had all the rights to dir, php etc.. and I still get the 400
> >
> >
> > "Ken Schaefer" wrote:
> >
> > > Are you getting 400 errors on all requests for those sites? Or just
some
> > > requests?
> > >
> > > Cheers
> > > Ken
> > >
> > >
> > > "Dan@done-that.com" <Dan@done-that.com@discussions.microsoft.com>
wrote
> in
> > > message news:E8B6B9C8-086B-4C91-8B7A-B303E0A97C23@microsoft.com...
> > > : My 2003 Web server was running fine untill we had a power Supply
> failure,
> > > we swapped the drives into another server (both SuperMicro 6010 with 2
> GB
> > > mem and dual 993 P3's.)
> > > :
> > > : But a couple of site now get 400 messages, I reloaded 2003, just in
> case
> > > we had hit a file, but no change. I looked at the log and what I see
is
> a
> > > : " 2004-06-19 21:13:46 192.168.0.5 4371 192.168.0.9 8098 - - - - -
> > > Timer_MinBytesPerSecond
> > > : " message which looks to be a timeout message
> > > :
> > > : I tried making a new virtual instance to see if it was tied to that
> > > instance's config and got same thing... Feel like a true dummy
> > > :
> > > : Dan   dan@done-that.com
> > >
> > >
> > >
>
>
>


Relevant Pages

  • experiment supports concept of using host header names as securit y layer
    ... ISAPI filters can't evaluate a request until a virtual site has been ... selected and its set of running ISAPI filters has become known to the IIS ... As a quick experiment in using a host header name as a security device, ...
    (Focus-Microsoft)
  • Re: using stream_context_create to make valid HTTP request headers
    ... While I do have the website's permission to fetch the feed, their host ... My script should now be making a valid request ... ... The User-Agent header should refer to the version of the software ... why do both of these headers refer to MYSITE? ...
    (comp.lang.php)
  • Re: IIS 5 Host Headers not working
    ... When a client makes a request to a server, it sends a HTTP header called ... "Host", like so: ...
    (microsoft.public.inetserver.iis)
  • [Full-disclosure] Re: strange domain name in phishing email
    ... It depends on the webserver whether it accepts the address in that form. ... sends a HTTP request. ... Part of HTTP since version 1.1 is the "Host:" header. ...
    (Full-Disclosure)
  • Re: IIS, VS.NET, ASP.NET
    ... Both of your websites on port 80 are distinguished only by the Host: header. ... Restarting IIS is not necessary (creating new website is ... If "reinstall Default Web Site " means to restore the same ...
    (microsoft.public.inetserver.iis)