Many requests from outside

[M5oul]

I have many logs which looks like there is many requests:

• /var/log/gogs/gogs.log:

2017/03/11 08:28:42 [TRACE] Template: status/404
2017/03/11 08:28:53 [TRACE] Session ID: 9bcc1af9ef618fb4
2017/03/11 08:28:53 [TRACE] CSRF Token: lffz4XU9xZiXdhzFKxal_9jeIM46MTQ4OTIxNzMzMzQ5NjQ2OTg1Mg==
2017/03/11 08:28:53 [TRACE] Template: status/404
2017/03/11 08:29:03 [TRACE] Session ID: 56ced370bcbbbb1a
2017/03/11 08:29:03 [TRACE] CSRF Token: OrW4Fug-7cvOnaxabQVc9bEc9h46MTQ4OTIxNzM0Mzk4MTYyMzI5MA==
2017/03/11 08:29:04 [TRACE] Template: status/404
2017/03/11 08:29:09 [TRACE] Session ID: 6aea6448471f54cf
2017/03/11 08:29:09 [TRACE] CSRF Token: CTQ2O0Ditwu-0FsejViuUqUBAvM6MTQ4OTIxNzM0OTQ1MzI0MjU5MA==

• /var/log/syslog:

Mar 11 08:27:47 moul gogs[1722]: [Macaron] 2017-03-11 08:27:47: Completed GET /42/21sh/commits/10f1569698122a6e242069e5c84182737c00b276/libft/get_next_line.h?lang=zh-CN
 302 Found in 668.227µs
Mar 11 08:27:47 moul gogs[1722]: [Macaron] 2017-03-11 08:27:47: Started GET /42/21sh/src/77d65a141787584a4151c3604903970ab760b2d8/libft/src/ft_strchr.c for 127.0.0.1
Mar 11 08:27:47 moul gogs[1722]: [Macaron] 2017-03-11 08:27:47: Completed GET /42/21sh/src/77d65a141787584a4151c3604903970ab760b2d8/libft/src/ft_strchr.c 404 Not Found 
in 32.453658ms
Mar 11 08:27:48 moul gogs[1722]: [Macaron] 2017-03-11 08:27:48: Started GET /42/21sh/src/f46452d11b650f1ae40860c147ca7fca11613e56/libft/src/ft_strncpy.c for [::1]
Mar 11 08:27:48 moul gogs[1722]: [Macaron] 2017-03-11 08:27:48: Completed GET /42/21sh/src/f46452d11b650f1ae40860c147ca7fca11613e56/libft/src/ft_strncpy.c 404 Not Found
 in 34.757889ms
Mar 11 08:27:48 moul gogs[1722]: [Macaron] 2017-03-11 08:27:48: Started GET /42/21sh/src/a709f14d8e91eea7081997622ad83a2c8c741560/libft/src/ft_strncpy.c for 127.0.0.1
Mar 11 08:27:48 moul gogs[1722]: [Macaron] 2017-03-11 08:27:48: Completed GET /42/21sh/src/a709f14d8e91eea7081997622ad83a2c8c741560/libft/src/ft_strncpy.c 404 Not Found
 in 69.764452ms
Mar 11 08:27:49 moul gogs[1722]: [Macaron] 2017-03-11 08:27:49: Started GET /42/21sh/src/572392ae46148e4d275543950762cf28d4166607/libft/src/ft_strchr.c for [::1]
Mar 11 08:27:49 moul gogs[1722]: [Macaron] 2017-03-11 08:27:49: Completed GET /42/21sh/src/572392ae46148e4d275543950762cf28d4166607/libft/src/ft_strchr.c 404 Not Found 
in 36.71086ms
Mar 11 08:27:50 moul gogs[1722]: [Macaron] 2017-03-11 08:27:50: Started GET /42/21sh/src/0beedc857492b8a4b4238545ef09fe0cd8f134b5/libft/src/ft_strncpy.c for 127.0.0.1
Mar 11 08:27:50 moul gogs[1722]: [Macaron] 2017-03-11 08:27:50: Completed GET /42/21sh/src/0beedc857492b8a4b4238545ef09fe0cd8f134b5/libft/src/ft_strncpy.c 404 Not Found
 in 37.875185ms

I decided to put my gogs instance under SSOwat protected_uris instead of unprotected_uris.
With this protection, there is no more such requests.

[M5oul]

With protected_uris it's not possible to communicate with the repository via https. Only ssh connection is possible.

[mbugeia]

maybe related (fix?) go-gitea/gitea#524

[M5oul]

That's a good implementation.
We could also add a fail2ban protection on account creation to avoid previous logs.