Re: [squid-users] WARNING: unparseable HTTP header field {:: }

On 12/11/2013 9:08 p.m., Dr.x wrote:
> hi ,
> is that harmfull log ??
> ====================================================================
> 2013/11/11 02:20:12 kid2| WARNING: unparseable HTTP header field {:: }
> 2013/11/11 02:20:13 kid1| ctx: exit level 0
> 2013/11/11 02:20:13 kid1| ctx: enter level 0:
> 'http://vap2iad3.lijit.com/www/delivery/lg.php?bannerid=38827&campaignid=232&cids=232&bids=38827&zoneid=220681&retarget_matches=null&tid=1075526134_220681_a90622ba5df04921Bd03a7abab3f6328&channel_ids=,&fpr=c874c715b2faad8885ad1254850d8d74&loc=http%3A%2F%2Fforum.mobilism.org%2Fviewtopic.php%3Ff%3D1292%26t%3D652520&referer=http%3A%2F%2Fforum.mobilism.org%2Fviewtopic.php%3Ff%3D1292%26t%3D652520&cb=78291847'
> 2013/11/11 02:20:13 kid1| WARNING: unparseable HTTP header field {:: }

I means the response to the URL shown contains corrupted HTTP headers.
Something outside the HTTP protool has been injected, So Squid will drop
the header, if relaxed_header_parser is disabled then the whole response
is dropped.

In this case the reponse is:

  HTTP/1.1 204 No Content
  Server: nginx
  Content-Type: text/html
  Connection: close
  Date: Tue, 12 Nov 2013 08:29:00 GMT
  P3P: CP="CUR ADM OUR NOR STA NID"
  Set-Cookie: ljt_reader=9927a11290d0240d8b2c3a6526658585; expires=Wed,
12-Nov-2014 08:29:00 GMT; path=/; domain=.lijit.com
  ::
  Expires: Thu, 01 Jan 1970 00:00:01 GMT
  Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
  Pragma: no-cache

Notice the line which contains only "::". Exactly as Squid reported.

Amos
Received on Tue Nov 12 2013 - 08:43:03 MST