Rodeoclash
Is anybody aware of any libraries for Phoenix that deal with bots sending malformed URLs?
Here’s an example:
[Phoenix.Router.MalformedURIError *MereWeb.Router.call/2*
](https://sentry.io/organizations/personal-6jx/issues/2746880988/?project=5996367&query=is%3Aunresolved)
malformed URI path: "/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"
I’m getting a bunch of entries like these showing up in my Sentry alerts and if anyone is aware of a plugin solution for this, I’d love to hear about it.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Phoenix, LiveView, multimedia pipelines, distributed systems. 400 engineers, Elixir since 2017. Available for hire.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 3 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
realcorvus
Here’s some more details on implementing PlugAttack, it’s a great library for dealing with this https://www.paraxial.io/blog/throttle-requests
BartOtten
Dealed with it last week. Fail2ban was not only the easiest but also the most effective solution. For Nginx we scraped the acces.log for 404’s.
lucaong
You could probably setup and configure plug_attack to block the offending IPs. See in particular the
fail2banrule function, with which you can fail specific requests, and temporarily ban IPs that keep trying them.Admittedly, I do not have experience with it, but it is very similar to Ruby’s rack-attack, that offers the same features in Ruby applications, and that I used in the past for these kind of cases.