<div dir="ltr">Benn,<div><br></div><div>I guess my explanation wasn't clear enough, so I'll try again.</div><div><br></div><div>That value is not coming from anywhere in your server's configuration - it has nothing to do with proxy_pass or anything else. It is the value of the "Referer" header that is in the incoming request.</div><div><br></div><div>First, are these log lines from requests that you are making to the server yourself, or are they coming from someone else?</div><div><br></div><div>If it is your own traffic, where are you making your requests from? Is it a page in a web browser, or is it some other tool?</div><div><br></div><div>If it is a web browser, that is usually the URL of the web page that is open in the browser. For example, if I have a website at `<a href="http://example.com/page.html`">example.com/page.html`</a> with a form on it that submits to your server, the value in that place in the logs will be `<a href="https://example.com/page.html`">https://example.com/page.html`</a> so that your server can see where the request came from.</div><div><br></div><div>Moshe</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 3, 2021 at 1:18 PM Benn Boulton <<a href="mailto:bboulton@skippingstone.com">bboulton@skippingstone.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="gmail-m_8833169596765304113WordSection1">
<p class="MsoNormal">Hello Moshe,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks for the reply. I guess I was not clear enough in my post. I know the /cr-bin/mp.exe is part of the POST request.
<u></u><u></u></p>
<p class="MsoNormal"> What I do not understand is where the <a href="http://gmer3.itd.sterling.com/home.htm" target="_blank">gmer3.itd.sterling.com/home.htm</a> is coming from. It is not my proxy_pass value.<u></u><u></u></p>
<p class="MsoNormal">It is not part of the POST request or part of the nginx proxy_pass or any thing I can find in my configuration.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Is my post being sent to both my proxy_pass value and this site in the log? Do I have a hacked nginx?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">-Benn<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> nginx <<a href="mailto:nginx-bounces@nginx.org" target="_blank">nginx-bounces@nginx.org</a>> <b>On Behalf Of
</b>Moshe Katz<br>
<b>Sent:</b> Thursday, June 3, 2021 12:14 PM<br>
<b>To:</b> <a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<b>Subject:</b> Re: <a href="http://gmer3.itd.sterling.com/home.htm" target="_blank">gmer3.itd.sterling.com/home.htm</a> in the access log<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Benn,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That part of the log is not the request URL, it is the referrer header. The path that was requested on your server is before that - a POST request to "/cr-bin/mp.exe". The referrer (which the HTTP standard actually misspells as "referer") is
the web page that is making this request to your server.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Moshe<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Jun 3, 2021 at 12:08 PM Benn Boulton <<a href="mailto:bboulton@skippingstone.com" target="_blank">bboulton@skippingstone.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal">I have just installed the NGINX service to help rate limit connections to my Apache server on Windows.<u></u><u></u></p>
<p class="MsoNormal">NGNIX 1.19.10 on Windows 10 64 bit<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Everything seems to be working fine but I am getting access log entries that I do not understand for the pages I am redirecting.<u></u><u></u></p>
<p class="MsoNormal">I am running a process that posts to the server. NGNIX is processing the request and passing it to the destination server but it is not
<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">
gmer3.itd.sterling.com/home.htm</a> as shown in the access log entries below.<u></u><u></u></p>
<p class="MsoNormal">Any Idea why<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:30:07 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:31:07 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:33:35 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:37:42 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:55:03 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal">127.0.0.1 - t_skipstone [03/Jun/2021:10:56:34 -0400] "POST /cr-bin/mp.exe HTTP/1.1" 200 569 "<a href="https://url.emailprotection.link/?bD5H3QzZ3V5r-EeQ1owgpRQF9oV5l2NRIm985JaimcuSK9Ouf7HkyYPBjb_5XEDTDFQOhTH2rYvU2h1CLfmBEfM8_cgt7-mqSW8-5oZbZzhsOjFEa1jMAMRarOyYb8wct" target="_blank">gmer3.itd.sterling.com/home.htm</a>"
"brow v1.0 CCI"<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thanks<u></u><u></u></p>
<p class="MsoNormal"><b><span style="color:rgb(27,62,111)">Benn
</span></b><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="https://url.emailprotection.link/?b0r-C9_AUw48-Ch5rHbhyfCAxCuaEcGez1jSw3TSmi_yMSerkqszEs29ZeJ-9XHhKXFPzhIWSbHbDCNUmj6Tzf9mgNn_Pt2ohe5UJSMuWw0QP3IvnnyCmFlsv4r_rtY2d" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>