I keep getting QUIT and CONNECT HTTP methods sent to my server, what do they mean?

Question

I keep getting the two following errors from my server, I assumed they were just bots looking for potential targets, but does anyone know specifically why I'm getting these? I'm using the SslRequirement plugin to make sure all hits to the login/signup page are redirected to SSL, so all of these weird https requests to root should just be redirected to regular http.

---

A ActionController::UnknownHttpMethod occurred in application#index: quit, accepted HTTP methods are get, head, put, post, delete, and options

/usr/local/lib/ruby/gems/1.9.1/gems/actionpack-2.3.4/lib/action_controller/request.rb:35:in `request_method'

• PATH_INFO : /
• REMOTE_ADDR : 99.19.208.249
• REMOTE_PORT : 6376
• REQUEST_METHOD : CONNECT
• REQUEST_URI : /
• SERVER_PORT : 443
• SERVER_PROTOCOL : HTTP/1.0
• SERVER_SOFTWARE : Apache

---

A ActionController::UnknownHttpMethod occurred in application#index: CONNECT, accepted HTTP methods are get, head, put, post, delete, and options

/usr/local/lib/ruby/gems/1.9.1/gems/actionpack-2.3.4/lib/action_controller/request.rb:35:in `request_method'

• HTTPS : on
• HTTP_X_FORWARDED_PROTO : https
• PATH_INFO : /
• REMOTE_ADDR : 91.209.196.76
• REMOTE_PORT : 50751
• REQUEST_METHOD : quit
• REQUEST_URI : /
• SERVER_PORT : 443
• SERVER_PROTOCOL : HTTP/0.9

Answer 1

CONNECT: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.9

QUIT usually means 'close the connection'.

Answer 2

The CONNECT command is used by HTTP proxy servers to indicate that the client wants to just connect a socket directly to another server; this is usually used for tunneling TLS over an HTTP proxy, but could be used for tunneling almost any protocol.

QUIT is not an HTTP command, but it is an SMTP command. It is possible that you are getting these commands from a bot that is trying to find open relays for sending spam; it's trying to figure out if you have an open SMTP relay, or an open HTTP proxy that allows the CONNECT command which could also be used to tunnel SMTP traffic.

So, likely you're just being hit by a spam botnet trying to find open relays. My advice would be to drop such requests as early as possible, and not worry about them.