Invalid request returns 500 instead of 400 in akka http server about akka-http HOT 6 CLOSED

Comment by ktoso
Wednesday Aug 24, 2016 at 08:30 GMT

Hm, what was the actual request?
I see how this could be instead interpreted as 400.

Possibly would require a change in exception type we use there, doable.

from akka-http.

Comment by ktoso
Wednesday Aug 24, 2016 at 08:31 GMT

You can always write a custom exception handler that would render this as a 400 btw

from akka-http.

Comment by francisdb
Wednesday Aug 24, 2016 at 09:34 GMT

We have no log of the actual request but let me try to reproduce this

from akka-http.

Comment by francisdb
Wednesday Aug 24, 2016 at 12:15 GMT

> telnet www.myserver.com 8088
Trying xxx.xxx.xxx.xxx...
Connected to www.myserver.com.
Escape character is '^]'.
GET htttp://foo.bar/test HTTP/1.1
Host: foo.bar

HTTP/1.1 500 Internal Server Error
Server: akka-http/2.4.9
Date: Wed, 24 Aug 2016 12:07:55 GMT
Connection: close
Content-Length: 0

Connection closed by foreign host.

Maybe some kind of crawler / hack tool tried this as a possible exploit? Would also be better if the log message contained the actual uri/schema.

Anyway, we don't want our logs polluted with 500 errors because of this stuff. Thanks for the workaround tip

from akka-http.

This is still happening. Looks like a nice first contribution to return a 400 message with a proper error message.

from akka-http.

I'd give it a try

from akka-http.