Drupal sets $_SERVER['HTTP_REFERER'] to the empty string when no Referer: header was sent

Are you using a proxy server that isn't allowing referrer reports to get to your Drupal installation? It sounds like it may be a server-configuration problem to me, since most browsers and personal computers allow and send referrer reports by default.

I am unable to get to the website you listed because of Bad Behavior kicking in as well. It sounds like you m,ay have an unique issue, as we have not received an influx of other users having this problem.

Are you sure the "Clatsop Community College" network doesn't have some kind of firewall preventing Bad Behavior from working? You should turn off any firewall temporarily for the purpose of troubleshooting your issue if possible.

Your best bet would be to disable all modules on the site except Bad Behavior and see if the issue still exists. There may be some incompatibility going on with your particular setup.

Any details would also be helpful in this:
Web Server Software:
Web Host:
Firewall settings if any:

It appears your site is working with the Bad Behavior module installed at this time. Would you mind reporting back to let us know what the problem was? It may help others in the future.

It is no longer blocking me. It was before.

This isn't really the issue forum to consult if you think it is the Bad Behavior logic, however, since it is a non-Drupal third-party script that handles all the blocking itself. You should go here to submit your problem and see if there is anything they can find out:

http://bad-behavior.ioerror.us/support/troubleshooting/

As a matter of fact, if you are getting the Bad Behavior "blocked" message, then the Drupal module is, in fact, working correctly. (Even if the Bad Behavior library isn't)

Since you disabled Drupal's internal caches, and still had to rename the library to get back in... that suggests that you may have some kind of Apache or PHP caching that is causing this behavior. You may want to look at this and add the Bad Behavior library to "exempted" files to those caches if possible. (Could be settings in caches such as MemCache, APC, mod_cache, etc...)

Also completely disable any browser caching that may interfere. Make sure, when running Bad Behavior, that you do not ever use "external" or "aggressive" caching in the Drupal settings.

If you're using APC then a simple restart of Apache may be all that is needed to make sure the newest PHP documents are all brought into cache whenever new modules or libraries are added/modified. Also, make sure you have the following settings stated in the APC section of your php.ini file:

apc.stat = 1
apc.include_once_override = 0

I've been having the same issue as jlea9378, and so I'm disabling this module until I can figure out what the heck is going on.

I'm having the same issue with http://vegan5technique.com. I'm logged in as admin with firefox and can view fine but if I use Google Chrome or Internet Exploroer I get:

Error 400

We're sorry, but we could not fulfill your request for / on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: 46c1-0338-6992-0ee5

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact vegan5technique at gmail.com and be sure to provide the technical support key shown above.

and can't view the site.

I also have no proxy's running and did not have this problem with the Drupal 6 version.

I did not have caching enabled when I installed BB and it still blocks Internet Explorer and Chrome but not Fire Fox though I installed when logged into the admin and have not logged out of fear of not getting back in.

@carsonw: I also have disabled the module because it was blocking everyone who came to my site.

It would appear the Bad Behavior Drupal module is working correctly. If you are having specific blocking issues, you will need to contact the Library maintainer at: http://bad-behavior.ioerror.us/support/troubleshooting/

If it is found that there is a problem with the Drupal module, I will look into this further.

I cannot reproduce this issue on a freshly installed Drupal 7 test site. So it doesn't seem to be an issue with the core Bad Behavior code. I'll keep poking at it, but I don't really expect to get too far. It might help if those of you running into this issue can provide a LOT of detail about your server environment, other Drupal modules in use, etc.

@error when I get a change I'll install another live site and go through each module to see if one keeps it from working like it is on my currect site.

One module right off the bat that might keep it from running correctly is the PHPIDS module: http://drupal.org/project/phpids.

Using the 7.x-1.x-dev version on a live site, when I get a change I'll check that one out.

Just tried disabling the PHPIDS module: http://drupal.org/project/phpids and it still blocks me from chrome and IE but not FireFox since I'm login as admin.

@jlea9378 Would comparing modules help narrow down the culprit?

Here is a screenshot of the modules I have installed and available. Hope this helps.

Hi, I have this same issue. Bad Behavior works great on Drupal 6 on the same server.

URI /favicon.ico
PROTOCOL HTTP/1.0
USER AGENT Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
HEADERS GET /favicon.ico HTTP/1.0 Host: libretechtips.com X-Forwarded-Host: libretechtips.com X-Forwarded-Server: libretechtips.com X-Forwarded-For: 190.152.33.194 Forwarded-Request-Uri: /favicon.ico Http-X-Forwarded-Proto: http Https: off X-Forwarded-Proto: http X-Forwarded-Ssl: off Connection: close Accept: */* User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Referer:
REQUEST ENTITY
DENIED REASON Header 'Referer' present but blank
EXPLANATION An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.
RESPONSE 400

@jlea9378 Confirmed, just installed @ http://8bitplatyp.us/drupal/, after that:

$ drush dl badbehavior
$ drush en badbehavior

Went to visit with Chrome and I get:

Error 400

We're sorry, but we could not fulfill your request for /drupal/ on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: 46c1-0a58-6992-0ee5

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact email and be sure to provide the technical support key shown above.

I just checked http://8bitplatyp.us/drupal/ and Bad Behavior seems to be working fine. Please let us all know what the secret to fixing this was!

I'm pretty well convinced at this point that there's some other code or configuration issue going on. I've now built two completely different test machines and been unable to reproduce the issue, with only the core extensions/themes and Bad Behavior installed.

I'd still like to track this down, obviously, so if you're having this issue, please send the following information:

• Web server software and version (e.g. Apache 2.2.23, IIS 7, nginx 1.0.15)
• PHP version (e.g. 5.3.19), SAPI (e.g. mod_php, fastcgi, fpm) and installation method (e.g. RPM/apt and which repository, binary download and where you got it, source code)
• The exact configuration directives from your server by which your web server talks to PHP (don't link to an Internet guide; you probably deviated from it anyway)
• The list of Drupal modules you have, which you can find with drush pm-list

Hopefully we can get to the bottom of this soon.

That's interesting... when I visit http://8bitplatyp.us/drupal/ in Safari I get this:

Error 400

We're sorry, but we could not fulfill your request for /drupal/ on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: 4540-ec47-6992-0ee5

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact 8bitplatypus at gmail.com and be sure to provide the technical support key shown above.

But I get to a Drupal login if I visit in Firefox on the same machine.

I'm running OSX 10.8.2, Safari Version 6.0.2 (8536.26.17), and Firefox 17.0.1.

@gregarios Using Firefox 16.0.2 & 17.0.1 I get the login page with no content which has not been created yet but Drupal usaly has some things to do for the start page.

Using Chrome Version 23.0.1271.95 m & Internet Explorer 9 64-bit I get the error.

@error Going to start gathering the information for you.

here I am getting 'Header 'Referer' present but blank'
is disabling BB is the only way?
:(
Drupal 7, Nginx, APC, within proxy.

I'm using a Webfaction host, which also uses Nginx on the frontend to forward requests to Apache. Could this have something to do with it?

Webhost is http://bluehost.com shared environment. They did not know what I was talking about for the rest of the information you requested but I did dig up this:

Apache: 2.2.20
PHP: 5.3.18
MySQL: 5.5.28-log
Architechture: x86_64
OS: Linux
Kernel version: 2.6.32-20120131.55.1.b

The list of Drupal modules you have, which you can find with drush pm-list Attached

How I installed Drupal and Babbehavior

$ wget http://ftp.drupal.org/files/projects/drupal-7.17.tar.gz

$ tar –zxvf drupal-7.17.tar.gz

Went to http://8bitplayp.us/drupal with Firefox 17 and went through the install.

Then:

$ drush dl badbehavior

$drush en badbehavior

Went to http://8bitplayp.us/drupal with Chrome and get the error page.

Have the newer browsers been ruled out?

@sb56637
I am also using webfaction,
BB is working great on Drupal 6 site. I am having trouble only on drupal 7 site.

same problem.

Error 400

We're sorry, but we could not fulfill your request for / on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: 76d0-abf2-6992-0ee5

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact contact at example.com and be sure to provide the technical support key shown above.

@Luen, Please post the information requested (see comment 27).

Will some of you try the complete zipped badbehavior module attached and report back? Make sure it isn't blocking you, and is still blocking spammers in the log. Thank you.

@gregarios

I removed the babehavior directory and the libraries directory and uninstalled from the modules section.

I unzipped and and transfered using SFTP and recreated the libraries directory with the newley transfered bad-behavior from the site.

Same results, still blocking me from Chrome and IE @ http://8bitplatyp.us/drupal

@ vinoth.3v (#34)
Ah, yes, I should have mentioned that I also run a Drupal 6 site on Webfaction with BadBehavior and it works fine. It's only the D7 site that has this error. But even so, I wonder if the Nginx passoff to Apache somehow affects the Drupal 7 implementation.

@ gregarios (#37)
I tried badbehavior7_mod_20121205a.zip, and it still gives me the same error. Thanks very much for looking into this error!

@ sb56637 (#39)
I have a separate nginx install on my account that handles both Drupal 6 & 7 sites. So I hope, it is not a issue of nginx/apache.

PHP Version 5.3.13
Server API CGI/FastCGI

that's all I can tell you.

I have the same error #14, #28..

I am uninstalling it untill some fix is found

Same here, works perfectly (AFAIK) on d6, blocks me (and others) on d7 - same environment.

On d7, when BB enabled, if I am logged in I can access site, but when log out - error 400 (logged http://example.com - access, new tab http://www.example.com - no access.

Your comments are 100% useless unless you read and follow the directions in comment #27. If you fail to do so, I will not be able to help you.

I don't use this module, but I've seen similar behavior before. I believe the problem is the assumption the referer, if present, will contain a value. That is not true; it is perfectly valid for the referer field to be empty (yet still sent), i.e. when the URL is typed into the browser location field or a bookmark is used. When the page is accessed by clicking on a link from another page, the referer field will contain a value.

I tested this hypothesis. First I entered http://8bitplayp.us/drupal into the location field (FF 17) and got the above noted error. However, when I came back here and clicked on the link in post #38 above, I got to the login page. Looking at the headers, the first did not send any content in the referer header; the second one did.

@jstuckle According to RFC 2616 it is not valid for Referer: to be blank. If present, it must be either an absoluteURI or a relativeURI as defined in RFC 2396. It is valid for the header to be omitted entirely. If you've found that the _browser_ is sending a blank Referer: field, then it's a browser bug, and should be dealt with through that channel. But since this is only affecting Drupal 7, and not Drupal 6 or any other platform on which Bad Behavior runs, I suspect that is not the case.

@error

But since this is only affecting Drupal 7, and not Drupal 6 or any other platform on which Bad Behavior runs, I suspect that is not the case.

When it did work on drupal 6, at the time I was using an older browser.

Has anyone confirmed that the newer browsers have this problem with drupal 6 also?

I can confirm this. I have both D6 and D7 sites running on nginx server behind proxy.
D6 site is working great. But D7 didn't.

I am using latest BB core and tested with FF 17.0.1 and Cromium 22 (Ubuntu 12.10)

@jlea9378 you can disable the module via drush to get back into the site:

drush dis badbehavior

I'd gladly fix it if I knew the cause.

Unfortunately, I didn't do the port to D7 and don't have any D7 installations to test it on.

If anyone out there can examine the version 7.x-2.x-dev Bad Behavior Drupal module code and come to a conclusion what is causing this, I'll patch it.

Any update on this?

Sorry unable to findout why. Bad behavior :)

Well, I have the same problem as everyone else on a site that's hosted at GoDaddy, (sigh). While I don't have anything really earth shaking to tell anyone, I did find that you can set up a whitelist of IP addresses in sites/all/libraries/bad-behavior. I haven't seen any mention of this handy back door; if you find yourself locked out of your own site and have access to files on the server, you can enter your IP address into the whitelist.ini and regain access to your site.

There is a file contained in the sites/all/libraries/bad-behavior directory called whitelist-sample.ini - change the name to whitelist.ini and then enter your IP address under the digg IP addresses here - I've replaced my own server IP's with x's here:

[ip]
; Digg whitelisted as of 2.0.12
ip[] = "64.191.203.0/24"
ip[] = "208.67.217.130"
; RFC 1918 addresses
ip[] = "10.0.0.0/8"
ip[] = "172.16.0.0/12"
ip[] = "192.168.0.0/16"
; Server IP for running cron.php:
ip[] = "xxx.xxx.xxx.xxx"
; Home computer for testing
 ip[] = "xxx.xxx.xxx.xxx"

Hopefully this issue gets resolved.

The error on my end was, there was a empty Referer in http header!

Nginx + php-fpm

The error on my end was, there was a empty Referer in http header!

That is indeed the immediate cause. The real question is, where is the empty Referer header coming from? I have still not been able to reproduce this, nor did a quick grep of the Drupal source reveal any place that this header might be accidentally set.

Well I'm chiming in here with the exact same issue being caused by blank headers in D7.

Drupal: 7.19
NGINX: 1.2.7-0ubuntu0ppa1~precise
PHP-FPM: 5.4
Macached: 1.4.13-0ubuntu2
PHP5-APC: 3.1.7-1

No proxies are in place on my server. Drupal Caching is active. NGINX uses a UNIX socket for communication with PHP-FPM. I have also noted that GoogleBOT and TwitterFeed are being blocked for the same reason, so it's not just users.

Drupal 7 Module list:

cache_bootstrap(bootstrap_modules) was not cleared. APC cli uses a different memory storage then   [warning]
the webserver. For more info see: http://drupal.org/node/1278232
cache_bootstrap(system_list) was not cleared. APC cli uses a different memory storage then the     [warning]
webserver. For more info see: http://drupal.org/node/1278232
cache_bootstrap(bootstrap_modules) was not cleared. APC cli uses a different memory storage then   [warning]
the webserver. For more info see: http://drupal.org/node/1278232
cache_bootstrap(system_list) was not cleared. APC cli uses a different memory storage then the     [warning]
webserver. For more info see: http://drupal.org/node/1278232
 Package             Name                                             Type    Status         Version          
 Access control      ACL (acl)                                        Module  Enabled        7.x-1.0.4-dev    
 Access control      Book access (book_access)                        Module  Not installed  7.x-2.0-rc1      
 Access control      Book access UI (book_access_ui)                  Module  Enabled        7.x-2.0-rc1      
 Access control      Forum Access (forum_access)                      Module  Enabled        7.x-1.2.3-dev    
 Administration      Actions permissions (VBO) (actions_permissions)  Module  Not installed  7.x-3.1.1-dev    
 Administration      Administration Development tools (admin_devel)   Module  Not installed  7.x-3.0-rc4      
 Administration      Administration menu (admin_menu)                 Module  Disabled       7.x-3.0-rc4      
 Administration      Administration menu Toolbar style                Module  Disabled       7.x-3.0-rc4      
                     (admin_menu_toolbar)                                                                     
 Administration      Fasttoggle (fasttoggle)                          Module  Enabled        7.x-1.x-dev      
 Administration      Fasttoggle Comment (fasttogglecomment)           Module  Enabled        7.x-1.x-dev      
 Administration      Fasttoggle Field (fasttogglefield)               Module  Enabled        7.x-1.x-dev      
 Administration      Fasttoggle Node (fasttogglenode)                 Module  Enabled        7.x-1.x-dev      
 Administration      Fasttoggle User (fasttoggleuser)                 Module  Enabled        7.x-1.x-dev      
 Administration      Module filter (module_filter)                    Module  Enabled        7.x-2.x-dev      
 Caching             Varnish (varnish)                                Module  Disabled       7.x-1.0-beta1.3- 
                                                                                             dev              
 Chaos tool suite    Bulk Export (bulk_export)                        Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Chaos tools (ctools)                             Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Chaos Tools (CTools) AJAX Example                Module  Not installed  7.x-1.2.31-dev   
                     (ctools_ajax_sample)                                                                     
 Chaos tool suite    Chaos Tools (CTools) Plugin Example              Module  Not installed  7.x-1.2.31-dev   
                     (ctools_plugin_example)                                                                  
 Chaos tool suite    Custom content panes (ctools_custom_content)     Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Custom rulesets (ctools_access_ruleset)          Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Page manager (page_manager)                      Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Stylizer (stylizer)                              Module  Enabled        7.x-1.2.31-dev   
 Chaos tool suite    Views content panes (views_content)              Module  Enabled        7.x-1.2.31-dev   
 Core                Aggregator (aggregator)                          Module  Enabled        7.19             
 Core                Block (block)                                    Module  Enabled        7.19             
 Core                Blog (blog)                                      Module  Enabled        7.19             
 Core                Book (book)                                      Module  Enabled        7.19             
 Core                Color (color)                                    Module  Enabled        7.19             
 Core                Comment (comment)                                Module  Enabled        7.19             
 Core                Contact (contact)                                Module  Not installed  7.19             
 Core                Content translation (translation)                Module  Enabled        7.19             
 Core                Contextual links (contextual)                    Module  Enabled        7.19             
 Core                Dashboard (dashboard)                            Module  Enabled        7.19             
 Core                Database logging (dblog)                         Module  Enabled        7.19             
 Core                Field (field)                                    Module  Enabled        7.19             
 Core                Field SQL storage (field_sql_storage)            Module  Enabled        7.19             
 Core                Field UI (field_ui)                              Module  Enabled        7.19             
 Core                File (file)                                      Module  Enabled        7.19             
 Core                Filter (filter)                                  Module  Enabled        7.19             
 Core                Forum (forum)                                    Module  Enabled        7.19             
 Core                Help (help)                                      Module  Enabled        7.19             
 Core                Image (image)                                    Module  Enabled        7.19             
 Core                List (list)                                      Module  Enabled        7.19             
 Core                Locale (locale)                                  Module  Enabled        7.19             
 Core                Menu (menu)                                      Module  Enabled        7.19             
 Core                Node (node)                                      Module  Enabled        7.19             
 Core                Number (number)                                  Module  Not installed  7.19             
 Core                OpenID (openid)                                  Module  Enabled        7.19             
 Core                Options (options)                                Module  Enabled        7.19             
 Core                Overlay (overlay)                                Module  Enabled        7.19             
 Core                Path (path)                                      Module  Enabled        7.19             
 Core                PHP filter (php)                                 Module  Enabled        7.19             
 Core                Poll (poll)                                      Module  Enabled        7.19             
 Core                RDF (rdf)                                        Module  Enabled        7.19             
 Core                Search (search)                                  Module  Enabled        7.19             
 Core                Shortcut (shortcut)                              Module  Not installed  7.19             
 Core                Statistics (statistics)                          Module  Enabled        7.19             
 Core                Syslog (syslog)                                  Module  Enabled        7.19             
 Core                System (system)                                  Module  Enabled        7.19             
 Core                Taxonomy (taxonomy)                              Module  Enabled        7.19             
 Core                Testing (simpletest)                             Module  Not installed  7.19             
 Core                Text (text)                                      Module  Enabled        7.19             
 Core                Toolbar (toolbar)                                Module  Enabled        7.19             
 Core                Tracker (tracker)                                Module  Enabled        7.19             
 Core                Trigger (trigger)                                Module  Enabled        7.19             
 Core                Update manager (update)                          Module  Not installed  7.19             
 Core                User (user)                                      Module  Enabled        7.19             
 Date/Time           Date (date)                                      Module  Enabled        7.x-2.6.2-dev    
 Date/Time           Date All Day (date_all_day)                      Module  Not installed  7.x-2.6.2-dev    
 Date/Time           Date API (date_api)                              Module  Enabled        7.x-2.6.2-dev    
 Date/Time           Date Context (date_context)                      Module  Not installed  7.x-2.6.2-dev    
 Date/Time           Date Migration (date_migrate)                    Module  Not installed  7.x-2.6.2-dev    
 Date/Time           Date Popup (date_popup)                          Module  Enabled        7.x-2.6.2-dev    
 Date/Time           Date Repeat API (date_repeat)                    Module  Enabled        7.x-2.6.2-dev    
 Date/Time           Date Repeat Field (date_repeat_field)            Module  Not installed  7.x-2.6.2-dev    
 Date/Time           Date Tools (date_tools)                          Module  Enabled        7.x-2.6.2-dev    
 Date/Time           Date Views (date_views)                          Module  Enabled        7.x-2.6.2-dev    
 Example modules     Variable example (variable_example)              Module  Not installed  7.x-2.2          
 Features            Date Migration Example (date_migrate_example)    Module  Not installed  7.x-2.0          
 Features            Features (features)                              Module  Enabled        7.x-2.0-beta1.5- 
                                                                                             dev              
 Fields              Entity Reference (entityreference)               Module  Enabled        7.x-1.0.4-dev    
 Fields              Entity Reference Behavior Example                Module  Not installed  7.x-1.0.4-dev    
                     (entityreference_behavior_example)                                                       
 Fields              Node Reference (node_reference)                  Module  Enabled        7.x-2.0.9-dev    
 Fields              Node Reference URL Widget (nodereference_url)    Module  Enabled        7.x-1.12         
 Fields              References (references)                          Module  Enabled        7.x-2.0.9-dev    
 Fields              User Reference (user_reference)                  Module  Enabled        7.x-2.0.9-dev    
 Flags               Flag (flag)                                      Module  Enabled        7.x-3.0-alpha4.6 
                                                                                             0-dev            
 Flags               Flag actions (flag_actions)                      Module  Enabled        7.x-3.0-alpha4.6 
                                                                                             0-dev            
 Flags               Flag Bookmark (flag_bookmark)                    Module  Enabled        7.x-3.0-alpha4.6 
                                                                                             0-dev            
 Form Elements       Hierarchical Select (hierarchical_select)        Module  Enabled        7.x-3.0-alpha5.9 
                                                                                             -dev             
 Form Elements       Hierarchical Select Flat List (hs_flatlist)      Module  Enabled        7.x-3.0-alpha5.9 
                                                                                             -dev             
 Form Elements       Hierarchical Select Menu (hs_menu)               Module  Not installed  7.x-3.0-alpha5.9 
                                                                                             -dev             
 Form Elements       Hierarchical Select Small Hierarchy              Module  Enabled        7.x-3.0-alpha5.9 
                     (hs_smallhierarchy)                                                     -dev             
 Form Elements       Hierarchical Select Taxonomy (hs_taxonomy)       Module  Enabled        7.x-3.0-alpha5.9 
                                                                                             -dev             
 Form Elements       Hierarchical Select Taxonomy Views               Module  Not installed  7.x-3.0-alpha5.9 
                     (hs_taxonomy_views)                                                     -dev             
 Input filters       Pathologic (pathologic)                          Module  Enabled        7.x-1.x-dev      
 Mail                Block user messages (pm_block_user)              Module  Enabled        7.x-2.x-dev      
 Mail                HTML Mail (htmlmail)                             Module  Enabled        7.x-2.65.1-dev   
 Mail                Mail MIME (mailmime)                             Module  Enabled        7.x-2.17         
 Mail                Mail System (mailsystem)                         Module  Enabled        7.x-3.0-alpha1   
 Mail                Private messages (privatemsg)                    Module  Enabled        7.x-2.x-dev      
 Mail                Privatemsg Email Notification (pm_email_notify)  Module  Enabled        7.x-2.x-dev      
 Mail                Privatemsg filter (privatemsg_filter)            Module  Enabled        7.x-2.x-dev      
 Mail                Privatemsg Groups (privatemsg_groups)            Module  Not installed  7.x-2.x-dev      
 Mail                Privatemsg Limits (privatemsg_limits)            Module  Enabled        7.x-2.x-dev      
 Mail                Privatemsg Realname Integration                  Module  Not installed  7.x-2.x-dev      
                     (privatemsg_realname)                                                                    
 Mail                Privatemsg roles (privatemsg_roles)              Module  Enabled        7.x-2.x-dev      
 Mail                Privatemsg Rules Integrations                    Module  Enabled        7.x-2.x-dev      
                     (privatemsg_rules)                                                                       
 Mail                SMTP Authentication Support (smtp)               Module  Enabled        7.x-1.0-beta2.7- 
                                                                                             dev              
 Media               File entity (file_entity)                        Module  Enabled        7.x-2.x-dev      
 Media               IMCE (imce)                                      Module  Enabled        7.x-1.7.1-dev    
 Media               Media (media)                                    Module  Enabled        7.x-2.0-unstable 
                                                                                             7.22-dev         
 Media               Media Field (mediafield)                         Module  Not installed  7.x-2.0-unstable 
                                                                                             7.22-dev         
 Media               Media Internet Sources (media_internet)          Module  Enabled        7.x-2.0-unstable 
                                                                                             7.22-dev         
 Multilanguage       Translation helpers (translation_helpers)        Module  Enabled        7.x-1.0          
 Multilingual        Localization client (l10n_client)                Module  Enabled        7.x-1.1          
 Multilingual        Localization update (l10n_update)                Module  Enabled        7.x-1.0-beta3.4- 
                                                                                             dev              
 Multilingual -      Entity Translation (entity_translation)          Module  Enabled        7.x-1.0-beta2.18 
 Entity Translation                                                                          -dev             
 Multilingual -      Entity Translation Menu                          Module  Enabled        7.x-1.0-beta2.18 
 Entity Translation  (entity_translation_i18n_menu)                                          -dev             
 Multilingual -      Entity Translation Upgrade                       Module  Enabled        7.x-1.0-beta2.18 
 Entity Translation  (entity_translation_upgrade)                                            -dev             
 Multilingual -      Block languages (i18n_block)                     Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Contact translation (i18n_contact)               Module  Not installed  7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Field translation (i18n_field)                   Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Internationalization (i18n)                      Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Menu translation (i18n_menu)                     Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Multilingual content (i18n_node)                 Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Multilingual forum (i18n_forum)                  Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Multilingual select (i18n_select)                Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Path translation (i18n_path)                     Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Rules translation (rules_i18n)                   Module  Enabled        7.x-2.2.5-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      String translation (i18n_string)                 Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Synchronize translations (i18n_sync)             Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Taxonomy translation (i18n_taxonomy)             Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Translation redirect (i18n_redirect)             Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Translation sets (i18n_translation)              Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      User mail translation (i18n_user)                Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Variable translation (i18n_variable)             Module  Enabled        7.x-1.8.2-dev    
 Internationalizati                                                                                           
 on                                                                                                           
 Multilingual -      Views translation (i18nviews)                    Module  Enabled        7.x-3.x-dev      
 Internationalizati                                                                                           
 on                                                                                                           
 Other               Advanced Forum (advanced_forum)                  Module  Enabled        7.x-2.x-dev      
 Other               AntiSpam (antispam)                              Module  Enabled        7.x-1.5.9-dev    
 Other               Chain Menu Access API (chain_menu_access)        Module  Enabled        7.x-2.0          
 Other               Code Filter (codefilter)                         Module  Enabled        7.x-1.0.13-dev   
 Other               Echo (echo)                                      Module  Enabled        7.x-1.9          
 Other               Entity API (entity)                              Module  Enabled        7.x-1.0.2-dev    
 Other               Entity tokens (entity_token)                     Module  Enabled        7.x-1.0.2-dev    
 Other               Flat comments (flatcomments)                     Module  Enabled        7.x-2.0.1-dev    
 Other               Follow (follow)                                  Module  Enabled        7.x-2.x-dev      
 Other               Git Deploy (git_deploy)                          Module  Enabled        7.x-2.2.3-dev    
 Other               Gravatar (gravatar)                              Module  Enabled        7.x-1.1.5-dev    
 Other               Imagecache Profile Pictures                      Module  Enabled        7.x-1.0.1-dev    
                     (imagecache_profiles)                                                                    
 Other               Insert (insert)                                  Module  Enabled        7.x-1.2          
 Other               IP address manager (ip)                          Module  Enabled        7.x-1.4          
 Other               Libraries (libraries)                            Module  Enabled        7.x-3.x-dev      
 Other               Mail Editor (mail_edit)                          Module  Enabled        7.x-1.0.7-dev    
 Other               No Current Password (nocurrent_pass)             Module  Enabled        7.x-1.0          
 Other               Node Convert (node_convert)                      Module  Enabled        7.x-1.1.7-dev    
 Other               Pathauto (pathauto)                              Module  Enabled        7.x-1.2.6-dev    
 Other               Qwebirc IRC (qwebirc)                            Module  Enabled        7.x-1.4          
 Other               Redirect (redirect)                              Module  Enabled        7.x-1.0-rc1.3-de 
                                                                                             v                
 Other               Smart Paging (smart_paging)                      Module  Enabled        7.x-1.7.1-dev    
 Other               Social Buttons (social_buttons)                  Module  Enabled        7.x-1.2.2-dev    
 Other               Token (token)                                    Module  Enabled        7.x-1.4.5-dev    
 Other               User Relationships Test module                   Module  Not installed  7.x-1.0-alpha5   
                     (user_relationships_test)                                                                
 Other               User restrictions (user_restrictions)            Module  Enabled        7.x-1.0-beta9    
 Other               User restrictions UI (user_restrictions_ui)      Module  Enabled        7.x-1.0-beta9    
 Other               Variable API (vars)                              Module  Enabled        7.x-2.0-alpha10  
 Performance and     Alternative PHP Cache (apc)                      Module  Enabled        7.19             
 scalability                                                                                                  
 Performance and     HTTP Parallel Request Library (httprl)           Module  Not installed  7.x-1.10         
 scalability                                                                                                  
 Performance and     Memcache (memcache)                              Module  Enabled        7.x-1.0.5-dev    
 scalability                                                                                                  
 Performance and     Memcache Admin (memcache_admin)                  Module  Enabled        7.x-1.0.5-dev    
 scalability                                                                                                  
 Rules               Rules (rules)                                    Module  Enabled        7.x-2.2.5-dev    
 Rules               Rules Scheduler (rules_scheduler)                Module  Enabled        7.x-2.2.5-dev    
 Rules               Rules UI (rules_admin)                           Module  Enabled        7.x-2.2.5-dev    
 Search Toolkit      Apache Solr Access (apachesolr_access)           Module  Enabled        7.x-1.1.34-dev   
 Search Toolkit      Apache Solr autocomplete                         Module  Enabled        7.x-1.3          
                     (apachesolr_autocomplete)                                                                
 Search Toolkit      Apache Solr framework (apachesolr)               Module  Enabled        7.x-1.1.34-dev   
 Search Toolkit      Apache Solr Indexer for Taxonomy                 Module  Enabled        7.x-1.x-dev      
                     (apachesolr_term)                                                                        
 Search Toolkit      Apache Solr Multilingual                         Module  Enabled        7.x-1.0-alpha2.2 
                     (apachesolr_multilingual)                                               7-dev            
 Search Toolkit      Apache Solr Multilingual Config Generator        Module  Not installed  7.x-1.0-alpha2.2 
                     (apachesolr_multilingual_confgen)                                       7-dev            
 Search Toolkit      Apache Solr search (apachesolr_search)           Module  Enabled        7.x-1.1.34-dev   
 Search Toolkit      Apache Solr Users (apachesolr_user)              Module  Enabled        7.x-1.x-dev      
 Search Toolkit      Apachesolr sort (apachesolr_sort)                Module  Enabled        7.x-1.x-dev      
 Search Toolkit      Current Search Blocks (current_search)           Module  Enabled        7.x-1.2          
 Search Toolkit      Facet API (facetapi)                             Module  Enabled        7.x-1.2          
 Spam control        Bad Behavior (badbehavior)                       Module  Enabled        7.x-2.2213       
 Spam control        CAPTCHA (captcha)                                Module  Enabled        7.x-1.0-beta2.15 
                                                                                             -dev             
 Spam control        Image CAPTCHA (image_captcha)                    Module  Enabled        7.x-1.0-beta2.15 
                                                                                             -dev             
 Spam control        reCAPTCHA (recaptcha)                            Module  Enabled        7.x-1.9-rc1      
 Spam control        reCAPTCHA Mailhide (recaptcha_mailhide)          Module  Enabled        7.x-1.9-rc1      
 Statistics          Google Analytics (googleanalytics)               Module  Enabled        7.x-1.2          
 User interface      AJAX Poll (ajax_poll)                            Module  Enabled        7.x-1.1.2-dev    
 User interface      jQuery Update (jquery_update)                    Module  Enabled        7.x-2.3-alpha1   
 User interface      Superfish (superfish)                            Module  Enabled        7.x-1.9-beta5.1- 
                                                                                             dev              
 User interface      User Details (user_details)                      Module  Enabled        7.x-3.1          
 User interface      Wysiwyg (wysiwyg)                                Module  Enabled        7.x-2.2.8-dev    
 User Relationships  User Relationships (user_relationships)          Module  Not installed  7.x-1.0-alpha5   
 User Relationships  User Relationships Blocks                        Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_blocks)                                                               
 User Relationships  User Relationships Defaults                      Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_defaults)                                                             
 User Relationships  User Relationships Elaborations                  Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_elaborations)                                                         
 User Relationships  User Relationships Implications                  Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_implications)                                                         
 User Relationships  User Relationships Invites                       Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_invites)                                                              
 User Relationships  User Relationships Mailer                        Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_mailer)                                                               
 User Relationships  User Relationships Node Access                   Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_node_access)                                                          
 User Relationships  User Relationships Panels Visibility             Module  Not installed  7.x-1.0-alpha5   
                     (user_relationships_panels_visibility)                                                   
 User Relationships  User Relationships Private Message               Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_privatemsg)                                                           
 User Relationships  User Relationships Rules                         Module  Not installed  7.x-1.0-alpha5   
                     (user_relationships_rules)                                                               
 User Relationships  User Relationships Services                      Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_service)                                                              
 User Relationships  User Relationships UI (user_relationships_ui)    Module  Not installed  7.x-1.0-alpha5   
 User Relationships  User Relationships Views                         Module  Not installed  7.x-1.0-alpha5   
                     (user_relationship_views)                                                                
 Variable            Variable (variable)                              Module  Enabled        7.x-2.2          
 Variable            Variable admin (variable_admin)                  Module  Enabled        7.x-2.2          
 Variable            Variable advanced (variable_advanced)            Module  Not installed  7.x-2.2          
 Variable            Variable realm (variable_realm)                  Module  Enabled        7.x-2.x          
 Variable            Variable store (variable_store)                  Module  Enabled        7.x-2.x          
 Variable            Variable views (variable_views)                  Module  Enabled        7.x-2.2          
 Views               Views (views)                                    Module  Enabled        7.x-3.5.37-dev   
 Views               Views Bulk Operations (views_bulk_operations)    Module  Enabled        7.x-3.1.1-dev    
 Views               Views Data Export (views_data_export)            Module  Enabled        7.x-3.0-beta6.25 
                                                                                             -dev             
 Views               Views RSS (views_rss)                            Module  Enabled        7.x-2.0-rc3.3-de 
                                                                                             v                
 Views               Views RSS: Core Elements (views_rss_core)        Module  Enabled        7.x-2.0-rc3.3-de 
                                                                                             v                
 Views               Views RSS: DC Elements (views_rss_dc)            Module  Enabled        7.x-2.0-rc3.3-de 
                                                                                             v                
 Views               Views UI (views_ui)                              Module  Enabled        7.x-3.5.37-dev   
 Voting              Plus 1 (plus1)                                   Module  Enabled        7.x-1.0-alpha1.1 
                                                                                             1-dev            
 Voting              Voting API (votingapi)                           Module  Enabled        7.x-2.10         
 XML sitemap         XML sitemap (xmlsitemap)                         Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap custom (xmlsitemap_custom)           Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap engines (xmlsitemap_engines)         Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap internationalization                 Module  Not installed  7.x-2.0-rc2      
                     (xmlsitemap_i18n)                                                                        
 XML sitemap         XML sitemap menu (xmlsitemap_menu)               Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap node (xmlsitemap_node)               Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap taxonomy (xmlsitemap_taxonomy)       Module  Enabled        7.x-2.0-rc2      
 XML sitemap         XML sitemap user (xmlsitemap_user)               Module  Enabled        7.x-2.0-rc2      
 Core                Bartik (bartik)                                  Theme   Disabled       7.19             
 Core                Garland (garland)                                Theme   Disabled       7.19             
 Core                Seven (seven)                                    Theme   Enabled        7.19             
 Core                Stark (stark)                                    Theme   Disabled       7.19             
 Other               brightstars (brightstars)                        Theme   Enabled        1.1 

I finally found the problem. There is actually a bug in the Drupal 7 core.

In function drupal_environment_initialize() in includes/bootstrap.inc, the first three lines are:

if (!isset($_SERVER['HTTP_REFERER'])) {
$_SERVER['HTTP_REFERER'] = '';
}

Referer, if present, MUST NOT be blank, according to RFC 2616, and so whatever reason this was put in for, it needs to be rewritten and/or removed. It interferes with Bad Behavior's check of the Referer value and offers absolutely no benefit to Drupal or anyone else, while inducing RFC-noncompliant behavior.

I presume this was added for Drupal's log entry, below in the same file, but there it is handled correctly, making this particular three lines of code redundant, useless and of course problematic. In fact the correct handling seems to be everywhere but modules/dblog/dblog.test which might fail in mysterious ways after this bug is fixed.

Those of you affected should try removing these erroneous lines of code to see if it causes any other issues.

Reassigning this to Drupal as it is a core issue and not a Bad Behavior module issue.

Yes, this works for me. I have not noticed any issues cause by this change in the drupal core code yet.
Thank you error.

Commenting line 637 in bootstrap.inc worked for me as indicated in post #61. Should we update the title to reflect the bug?? "HTTP_REFERER" should not be blank" or something?

What is the HTTP_REFERER variable before it gets assigned as "blank" in this case? Null?

Before this code sets it to the empty string, the key doesn't exist in $_SERVER. It's not meant to, since the HTTP server never sent it in the first place. And that's because in the case where it doesn't exist, the browser never sent it.

There's a significant semantic difference between the header not being sent, and the header being sent with an empty value. (Specifically, RFC 2616 bans the latter.) This may not be important to Drupal's log, which treats them both the same, but modules such as this one may rely on being able to detect the difference.

As suggested, I've changed the issue title and tags. (Regression, as this behavior was not present in Drupal 6, and Quick fix, since fixing it is a three line change that doesn't appear to break any functionality.)

Has anyone reported this to drupal core so that we don't have to hack core? (since hacking core is the ultimate no-no in drupal development)

This did indeed fix the problem for me, but I'd really rather not have to change any of my core files.

Ran into the same issue.

If I did a search and found my site via link then I could get to it without being blocked. If I did a direct access, then I was blocked.

Not a programmer but I am behind cloud flare. I do get the IP addresses, I also am getting some visitors while badbehavior is on.

Not sure if that helps or not.

The same code exists in Drupal 8. Please port the patch there first.

Any further progress on this issue? I miss using Bad-behavior...

73: 1824360-73-bootstrap-http-referer-rfc2616-d7.patch queued for re-testing.

can someone please fix this for drupal 7?

Just wanting to report that #73 worked just fine for my D7 site, although the patch had an offset for Hunk #1 of 4 lines (which may be why it is listed as "failed testing").

For those needing a quick fix, #73 is completely safe.

75: 1824360-72-bootstrap-http-referer-rfc2616-d8.patch queued for re-testing.

Hi, I'm a D7 user facing the same errors. Which patch should I apply? Is there a secure one?

Thank you.

Sorry if i missed something but didn't #73 fail the test?

Here's a rerolled d8 patch.

Hiding files

bot agrees, this is good to go

Committed/pushed to 8.x, thanks!

This was patched in 8.x (which, btw, was then removed entirely in the great kernel migration.

Unfortunately, it never made it into 7.x, where it is needed.

I'm re-uploading #73 so Testbot won't continually re-test the 8.x patch in #91 when I set the issue to RTBC. I am not the author and the patch should not be attributed to me.

The changes are the same as what went into 8.x, with an additional change to another test. Once the patch is applied the code in bootstrap.inc is removed and all instances of $_SERVER['HTTP_REFERER'] in 7.x are checked with isset().

This will lead to PHP notices in various contrib modules that expect $_SERVER['HTTP_REFERER'] to be present.

Question: If the patch were changed to do $_SERVER['HTTP_REFERER'] = NULL rather than $_SERVER['HTTP_REFERER'] = '' would that still solve the bug?

I tried changing this line:
$_SERVER['HTTP_REFERER'] = '';

to this:
$_SERVER['HTTP_REFERER'] = NULL;

Unfortunately, that change didn't fix the problem.

I'm running
- Drupal 7.35
- Bad Behavior module 7.x-2.2216
- Bad Behavior library 2.2.15.

So, pretty recent versions of everything. However, the only thing I found that fixes the problem is patch #73.

Just out of curiosity, which contrib modules will generate the PHP notice when patched?

Also, what is the notice message?

Could not apply the patch with git for the latest version of Drupal 7.x . Keep getting directory error. I can confirm patch is in the same directory as the file, weird.

@xiaomo for patches to drupal core the patch must be where your drupal core resides, the same folder as index.php

Oh, that might've been why. I just manually did it. Thank you for the info.

Just out of curiosity, which contrib modules will generate the PHP notice when patched?

I took a look through a couple codebases and found these possible examples:
http://cgit.drupalcode.org/twitter/tree/twitter_signin/twitter_signin.mo...
http://cgit.drupalcode.org/print/tree/print.pages.inc?h=7.x-2.0#n78
http://cgit.drupalcode.org/print/tree/print_mail/print_mail.inc?h=7.x-2....

I haven't tested those manually, but I assume there are others also.

I'm sympathetic to doing some kind of core fix here since it seems like it should not be an empty string, but setting it explicitly to NULL is a legitimate way in PHP of saying "the value does not exist" so it seems like that should be sufficient.

I took a look at the Bad Behavior library and it seems like the only reason that won't work is that it uses array_key_exists() rather than isset() in a couple places, for example common_tests.inc.php:

if (array_key_exists('Referer', $package['headers_mixed'])) {
	// Referer, if it exists, must not be blank
	if (empty($package['headers_mixed']['Referer'])) {
		return "69920ee5";
	}

and post.inc.php:

// If Referer exists, it should refer to a page on our site
if (!$settings['offsite_forms'] && array_key_exists('Referer', $package['headers_mixed'])) {
	$url = parse_url($package['headers_mixed']['Referer']);

I don't know if there's a good reason they need to use array_key_exists() over isset(), but if not then proposing an upstream patch to change that would help solve this.

Or if that's not feasible, it seems like the Drupal Bad Behavior module could deal with it just by unsetting an empty/NULL $_SERVER['HTTP_REFERER'] before calling into the Bad Behavior library (in fact, it could even do that with or without this core patch)?

@David_Rothstein, please see comments #48, #61 and #65.

@error, yup, but see what I wrote above:

I'm sympathetic to doing some kind of core fix here since it seems like it should not be an empty string, but setting it explicitly to NULL is a legitimate way in PHP of saying "the value does not exist" so it seems like that should be sufficient.

If Drupal 7 weren't released yet it would be one thing, but a lot of code out there does seem to rely on this array key always existing and Drupal 7 has guaranteed that it exists for a long, long time...

#120 and #122 still apply. No answers to those, so I'm moving this back to "needs work".