I maintain a Rails app. Every page except login and forgot password requires user authentication. Yesterday I noticed entries like this one in the access logs:54.209.60.63 - - [03/Nov/2015:19:09:53 +0000] GET /compendia HTTP/1.1 302 120 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:19:09:53 +0000] GET /login HTTP/1.1 200 927 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:19:10:37 +0000] GET /noumena/428 HTTP/1.1 302 120 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:19:10:37 +0000] GET /login HTTP/1.1 200 928 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:19:15:11 +0000] GET /data_ranges/1208/edit HTTP/1.1 302 120 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:19:15:11 +0000] GET /login HTTP/1.1 200 926 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:20:22:01 +0000] GET /fields/392 HTTP/1.1 302 120 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:20:22:01 +0000] GET /login HTTP/1.1 200 926 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.2554.209.60.63 - - [03/Nov/2015:21:55:29 +0000] GET /users HTTP/1.1 500 1477 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25Each of the requests was properly redirected back to the login page. Still, those URLs would be valid for authenticated users. And anonymous users could not be able to know those URLs.Is there some legitimate use case here? Or is one of my users compromised, and somehow they are leaking URLs but not credentials?
Mysterious visits to privileged URLs from anonymous user/bot
web crawlers;logging
Are you displaying ads on your site from Amobee (formerly known as Kontera)?The PTR record for this IP is nat.aws.kontera.com, suggesting that it is a crawler looking for your page's content in order to determine what ads may be relevant to that URL.If you've loaded the Kontera JavaScript on login-protected pages, then you will find that they are crawled any time a logged-in user visits those pages. Try removing the JavaScript call from protected pages, and see if the crawling of those pages stops.It's also possible that code has been added to the web page by a man in the middle attack before it reached the user who actually visited your site. Such an attack might have been launched by a network operator or malicious party in order to gain revenue from your content, or for other reasons.This is one of many reasons that every web site should run on HTTPS.