title: Preventing external requests expressjs
body: <p>Using expressjs with the morgan middleware for logging, I have noticed some frequent and alarming requests in the server logs.</p>
  
  <p>Relevant logger code</p>
  
  <pre><code>var app = express();
  app.use(morgan(':remote-addr - [:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length] ":referrer" ":user-agent"'));
  </code></pre>
  
  <p>as such, examples of the logs are</p>
  
  <pre><code>::ffff:(redacted) - [Fri, 24 Jul 2015 04:16:32 GMT] "GET / HTTP/1.1" 200 29294 "-" "-"
  ::ffff:(redacted) - [Fri, 24 Jul 2015 04:17:30 GMT] "GET http://example.com/path.php HTTP/1.1" 200 34523 "-" "-"
  ::ffff:(redacted) - [Fri, 24 Jul 2015 04:17:36 GMT] "GET /path HTTP/1.1" 200 29294 "-" "-"
  </code></pre>
  
  <p>Unfortunately I have no clue how to reproduce such an error. Is this a potential vulnerability? Log forging? Where might I find further information?</p>
  
  <p>Specifically, this line where the url is "GET <a href="http://example.com/path.php" rel="nofollow">http://example.com/path.php</a> HTTP/1.1", where example.com is NOT my domain, nor is my server set up to make requests to this example.com. Normally just a path (ie, /example, /path, /) is displayed here. In addition, these lines typically appear as part of obvious vulnerability scans from external IPs, and the response of 200 worries me. Are the logs indicating an outbound request? Is someone somehow using my server as a proxy?</p>