<p>Most likely since it's a production site, it's from bots/scripts hitting the site's login page probing for vulnerabilities.</p>

<p>I'd suggest changing the <a href="https://docs.craftcms.com/v3/config/config-settings.html#cptrigger" rel="nofollow noreferrer">cpTrigger</a> config setting and see if the occurrences go down.</p>

CC BY-SA 4.0
2019-12-19T13:28:21.650Z
I've noticed this too recently on a couple of C3 sites.
Mark
CC BY-SA 4.0
2019-10-31T21:45:43.167Z
Thanks Brad, but I'm not sure that's the case in this instance: for one thing we're already using a custom cpTrigger, plus the (very large) request volume and the timing / pattern of requests is such that it seems to match that of "real" traffic to the front end of the site. Is there a way to see what path is being hit when the warning is triggered? I can't see anything in the dump of `$_SERVER` in the log output
Tom Davies
CC BY-SA 4.0
2019-11-02T00:40:41.217Z
Hrm... devMode would log a bunch more info to help you track it down, but you probably don't want to enable that on production.  You could do a quick module/plugin that had a custom log target (could still be file based) where you log whatever information you want regardless of devMode.
Brad Bell
CC BY-SA 4.0
2019-11-05T13:33:42.650Z
That's a good idea - thanks Brad, I'll give it a go and update here with an answer when I figure it out
Tom Davies
CC BY-SA 4.0
2019-11-20T15:48:00.047Z
Tom - has there been an update on this on your end?  I've been seeing similar issues on a production site to this and am also trying to find a good starting point for trying to troubleshoot.
gjhead
CC BY-SA 4.0
2019-11-26T11:28:55.930Z
@gjhead not yet - it's still in my backlog, just not at the top. My plan is to use a custom module to log out to a custom file some of the stuff we'd otherwise get from having `devMode` on, and use that to inspect exactly what Craft / PHP is seeing in the request.
Tom Davies
CC BY-SA 4.0
2019-10-31T19:35:47.237Z
2019-10-31T19:35:47.237Z
Brad Bell
<p>On a production site, we're seeing a ton of the following warning in our <code>web.log</code> files for (seemingly) every request, creating a ton of noise in the logs and making it hard to spot "real" issues: </p>

<pre><code>&lt;DATE&gt; [-][-][-][warning][craft\web\User::_validateUserAgentAndIp] Request didn’t meet the user agent and IP requirement for maintaining a user session.
</code></pre>

<p><a href="https://github.com/craftcms/cms/blob/004ab9ede036aa22bddd3f2b472c16e11bd8d55d/src/web/User.php#L536-L550" rel="nofollow noreferrer">Under the hood</a> <code>craft\web\User::_validateUserAgentAndIp()</code> does the following </p>

<pre><code>private function _validateUserAgentAndIp(): bool
{
    if (!Craft::$app-&gt;getConfig()-&gt;getGeneral()-&gt;requireUserAgentAndIpForSession) {
        return true;
    }
    $request = Craft::$app-&gt;getRequest();
    if ($request-&gt;getUserAgent() === null || $request-&gt;getUserIP() === null) {
        Craft::warning('Request didn’t meet the user agent and IP requirement for maintaining a user session.', __METHOD__);
        return false;
    }
    return true;
}
</code></pre>

<p>As far as I can see, (for front end templates at least) <code>craft.app.request.userAgent</code> and <code>craft.app.request.userIP</code> are correctly populated with the UA and IP respectively, so I'm not sure why/how Craft is throwing this warning.</p>

<p>We don't see the same issue in dev / staging environments, so I know this is likely to be a configuration issue, but I'm asking this question to try and understand what's going on so I have some idea of what to look for.</p>

<p>Question:</p>

<ul>
<li>What should I look for / how can I debug what's causing this issue?</li>
</ul>

<p><em>(Note: I know I could turn <code>requireUserAgentAndIpForSession</code> off in <code>config/general.php</code>, but I don't really want to do that from a security POV)</em></p>

<p>Notes:</p>

<ul>
<li>This is on a site running Craft 3.3.13 (latest at time of writing)</li>
<li>It's in a load-balanced environment</li>
<li>We're using nginx as our webserver</li>
</ul>

<craft3><session><logs><debugging>
How can I debug `craft\web\User::_validateUserAgentAndIp()` warnings
# How can I debug `craft\web\User::_validateUserAgentAndIp()` warnings

(Asked by: username_0 on 2019-10-31)

On a production site, we're seeing a ton of the following warning in our web.log files for (seemingly) every request, creating a ton of noise in the logs and making it hard to spot "real" issues: 
 [-][-][-][warning][craft\web\User::_validateUserAgentAndIp] Request didn’t meet the user agent and IP requirement for maintaining a user session.

Under the hood craft\web\User::_validateUserAgentAndIp() does the following 
private function _validateUserAgentAndIp(): bool
{
    if (!Craft::$app->getConfig()->getGeneral()->requireUserAgentAndIpForSession) {
        return true;
    }
    $request = Craft::$app->getRequest();
    if ($request->getUserAgent() === null || $request->getUserIP() === null) {
        Craft::warning('Request didn’t meet the user agent and IP requirement for maintaining a user session.', __METHOD__);
        return false;
    }
    return true;
}

As far as I can see, (for front end templates at least) craft.app.request.userAgent and craft.app.request.userIP are correctly populated with the UA and IP respectively, so I'm not sure why/how Craft is throwing this warning.
We don't see the same issue in dev / staging environments, so I know this is likely to be a configuration issue, but I'm asking this question to try and understand what's going on so I have some idea of what to look for.
Question:

What should I look for / how can I debug what's causing this issue?

(Note: I know I could turn requireUserAgentAndIpForSession off in config/general.php, but I don't really want to do that from a security POV)
Notes:

This is on a site running Craft 3.3.13 (latest at time of writing)
It's in a load-balanced environment
We're using nginx as our webserver

**Tags:** craft3, session, logs, debugging


---

## 1 answers

### Answer by username_1 on 2019-10-31. Score: 1

Most likely since it's a production site, it's from bots/scripts hitting the site's login page probing for vulnerabilities.

I'd suggest changing the [cpTrigger](https://docs.craftcms.com/v3/config/config-settings.html#cptrigger) config setting and see if the occurrences go down.

> **Comments:**
> **username_0**: Thanks Brad, but I'm not sure that's the case in this instance: for one thing we're already using a custom cpTrigger, plus the (very large) request volume and the timing / pattern of requests is such that it seems to match that of "real" traffic to the front end of the site. Is there a way to see what path is being hit when the warning is triggered? I can't see anything in the dump of `$_SERVER` in the log output  
> **username_1**: Hrm... devMode would log a bunch more info to help you track it down, but you probably don't want to enable that on production.  You could do a quick module/plugin that had a custom log target (could still be file based) where you log whatever information you want regardless of devMode.  
> **username_0**: That's a good idea - thanks Brad, I'll give it a go and update here with an answer when I figure it out  
> **username_3**: Tom - has there been an update on this on your end?  I've been seeing similar issues on a production site to this and am also trying to find a good starting point for trying to troubleshoot.  
> **username_0**: @username_3 not yet - it's still in my backlog, just not at the top. My plan is to use a custom module to log out to a custom file some of the stuff we'd otherwise get from having `devMode` on, and use that to inspect exactly what Craft / PHP is seeing in the request.  
> **username_2**: I've noticed this too recently on a couple of C3 sites.  

---

