'Error: Malformed Request' in WWW proxy logs

[boblowski]

Every day I notice several 'Error: Malformed Request' notices in our WWW proxy log. I always assumed they are from scripts or people looking for known webserver vulnerabilities, but recently noticed some IP's for those errors are from legitimate visitors/robots.

So that made me wonder, what exactly is a 'malformed request' for WinGate? And is there any way to record the actual request so I can check it? Or are tools like Wireshark the only option to find out?

[adrien]

In WinGate 6.x "Malformed request" means the client sent a server request (as if WinGate is the server), and WinGate is configured to reject such requests.

Default settings for the default website in WinGate is to deny, so if you are using host headers to specify reverse proxying, that implies the client sent a request that didn't match any of those headers.

Regards

Adrien