2

Our .Net 4.5 production website is recieving multiple requests like this:

The requests are getting intercepted by the .Net request validation as they should but I would like to understand where those requests are coming from. The users are valid users and for some reason their browser seems to be appending 'javascript:false' to the request We have only seen it from a handful of users with the following User-Agent strings

  • Mozilla/4.0+compatible;+MSIE+8.0;+Windows+NT+6.0;+Trident/4.0;+FunWebProducts;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+InfoPath.1;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30618;+FunWebProducts;
  • Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+Win64;+x64;+Trident/5.0

Does anyone have an idea of where the javascript:false is coming from? If we cannot prevent the users browser from sending this extra string is there a way to just strip invalid characters from the request instead of throwing an Exception?

3
  • Check the referrer for bad links.
    – jrummell
    Feb 20, 2013 at 19:23
  • Have those users run malware detection
    – stark
    Feb 20, 2013 at 19:29
  • It only happens to a few users and I haven't heard from them directly. I only noticed because the site alerts us when there are errors and I was getting annoyed by this particular alert.
    – Shaun Bowe
    Feb 20, 2013 at 19:37

1 Answer 1

2

These requests are from user agents mindlessly following a <a href="javascript:false"> or similar. They are bots faking a browser user agent. The bots are interpreting the javascript URL as a relative URL because they are buggy or their human owners don't care.

This is a normal occurrence when you run a website. You'll see all kind of crazy stuff in the logs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.