XF 1.5 404 on /forum/login/login/login

[rfc0001]

Hi, I'm looking through the top 404 errors on my server, and the #1 is a 404 on /forum/login/login/login with referrer /forum/login/ so I know this isn't users typing this in erroneously, rather the actual login page referencing this URL. I've never seen a 404 error directly or had anyone report any issues with registration (/forum/login/login), so I'm wondering if there is some erroneous reference somewhere to this non-existent page somewhere or a honeypot or something? There are 850 404s just this month alone, so seems to be happening pretty regularly. I could always create a 301 to redirect /forum/login/login/login to /forum/login/login, but "fixing" this may end up breaking the way it is working now with the error. Is this something others can confirm, or know what is causing? Thanks.

 

[DWJames]

Hi, @rfc0001, did you resolve this issue?
I'm wondering the same...
thanks,
James

 

[rfc0001]

Hi, @rfc0001, did you resolve this issue?
I'm wondering the same...
thanks,
James

Nope

 

[Alpha1]

I have seen this error on a number of installations. Some without addons. I wonder if this could be an exotic bug.

 

[S Thomas]

with referrer /forum/login/ so I know this isn't users typing this in erroneously, rather the actual login page referencing this URL.

This is false conclusion, referrers can be faked and this more or less looks like a standard scrapper. I wouldn't be worried about it.

 

[rfc0001]

This is false conclusion, referrers can be faked and this more or less looks like a standard scrapper. I wouldn't be worried about it.

I doubt this is malicious activity given the volume of these errors. I'm not worried about it, but seems like there some misbehaving/misconfigured code somewhere.

 

[S Thomas]

Check your access.log what other pages in which frequency get called from the ips which generate those 404s.

 

[Alpha1]

Do you use a pixelexit style by any chance? Xenforo has an url /login/login
In the source of that page I did find a style reference for xenbase to /login so in theory that could explain for /login/login/login
But I don't see how the url would actually be called.

Maybe @Russ has an idea about this.

 

[S Thomas]

/login would go to the root of the site (your.site/login), so no chance for /login/login/login. If it was login (no leading slash), then you might have a point.

 

[Alpha1]

Its this part:

<li class="navTab PopupClosed xbGuestLogin">
                    <label for="LoginControl"><a href="login/" class=" navLink"> <span class="xbVisitorText">Log in</span></a></label>
            </li>

It has a trailing slash. Not a leading slash.

 

[S Thomas]

Yep, that would form a /login/login/login if it was included (and only there) in the login/login site, which is the login form when you call it directly. So your guest would have to manually open the login page.

 

[Alpha1]

/login/login is also opened if you enter an invalid name on the login bar. Which happens if someone tries to create an account that already exists. Which happens if the user intended to log in or has a password manager autofill the form.

 

[rfc0001]

Do you use a pixelexit style by any chance? Xenforo has an url /login/login
In the source of that page I did find a style reference for xenbase to /login so in theory that could explain for /login/login/login
But I don't see how the url would actually be called.

Maybe @Russ has an idea about this.

Never heard of it

 

[ActorMike]

I'm seeing this is my log files as well.

 

[HWS]

I can confirm the 404 for /login/login/login being the most frequent 404 at our site. Have to find the reason yet.

For the moment we do a redirect to /login/login at server level.

 

[Ozzy47]

“login” is the login form, “login/login” is what processes the login.

 

[ActorMike]

Maybe it's bots?

 

[HWS]

“login” is the login form, “login/login” is what processes the login.

And login/login/login is a 404. ;-)

A POST to this (wrong) location happens very often for an unknown reason. I now tried to change "login/login" in the templates to "/login/login" as our XF is in root anyway. Let's see if this helps.