Answers.Body: <p>Most likely since it's a production site, it's from bots/scripts hitting the site's login page probing for vulnerabilities.</p>
  
  <p>I'd suggest changing the <a href="https://docs.craftcms.com/v3/config/config-settings.html#cptrigger" rel="nofollow noreferrer">cpTrigger</a> config setting and see if the occurrences go down.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-19T13:28:21.650Z
Answers.Text: I've noticed this too recently on a couple of C3 sites.
Answers.UserDisplayName: Mark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-10-31T21:45:43.167Z
Answers.Text: Thanks Brad, but I'm not sure that's the case in this instance: for one thing we're already using a custom cpTrigger, plus the (very large) request volume and the timing / pattern of requests is such that it seems to match that of "real" traffic to the front end of the site. Is there a way to see what path is being hit when the warning is triggered? I can't see anything in the dump of `$_SERVER` in the log output
Answers.UserDisplayName: Tom Davies
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-02T00:40:41.217Z
Answers.Text: Hrm... devMode would log a bunch more info to help you track it down, but you probably don't want to enable that on production.  You could do a quick module/plugin that had a custom log target (could still be file based) where you log whatever information you want regardless of devMode.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-05T13:33:42.650Z
Answers.Text: That's a good idea - thanks Brad, I'll give it a go and update here with an answer when I figure it out
Answers.UserDisplayName: Tom Davies
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-20T15:48:00.047Z
Answers.Text: Tom - has there been an update on this on your end?  I've been seeing similar issues on a production site to this and am also trying to find a good starting point for trying to troubleshoot.
Answers.UserDisplayName: gjhead
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-26T11:28:55.930Z
Answers.Text: @gjhead not yet - it's still in my backlog, just not at the top. My plan is to use a custom module to log out to a custom file some of the stuff we'd otherwise get from having `devMode` on, and use that to inspect exactly what Craft / PHP is seeing in the request.
Answers.UserDisplayName: Tom Davies
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-10-31T19:35:47.237Z
Answers.LastActivityDate: 2019-10-31T19:35:47.237Z
Answers.UserDisplayName: Brad Bell
Body: <p>On a production site, we're seeing a ton of the following warning in our <code>web.log</code> files for (seemingly) every request, creating a ton of noise in the logs and making it hard to spot "real" issues: </p>
  
  <pre><code>&lt;DATE&gt; [-][-][-][warning][craft\web\User::_validateUserAgentAndIp] Request didn’t meet the user agent and IP requirement for maintaining a user session.
  </code></pre>
  
  <p><a href="https://github.com/craftcms/cms/blob/004ab9ede036aa22bddd3f2b472c16e11bd8d55d/src/web/User.php#L536-L550" rel="nofollow noreferrer">Under the hood</a> <code>craft\web\User::_validateUserAgentAndIp()</code> does the following </p>
  
  <pre><code>private function _validateUserAgentAndIp(): bool
  {
      if (!Craft::$app-&gt;getConfig()-&gt;getGeneral()-&gt;requireUserAgentAndIpForSession) {
          return true;
      }
      $request = Craft::$app-&gt;getRequest();
      if ($request-&gt;getUserAgent() === null || $request-&gt;getUserIP() === null) {
          Craft::warning('Request didn’t meet the user agent and IP requirement for maintaining a user session.', __METHOD__);
          return false;
      }
      return true;
  }
  </code></pre>
  
  <p>As far as I can see, (for front end templates at least) <code>craft.app.request.userAgent</code> and <code>craft.app.request.userIP</code> are correctly populated with the UA and IP respectively, so I'm not sure why/how Craft is throwing this warning.</p>
  
  <p>We don't see the same issue in dev / staging environments, so I know this is likely to be a configuration issue, but I'm asking this question to try and understand what's going on so I have some idea of what to look for.</p>
  
  <p>Question:</p>
  
  <ul>
  <li>What should I look for / how can I debug what's causing this issue?</li>
  </ul>
  
  <p><em>(Note: I know I could turn <code>requireUserAgentAndIpForSession</code> off in <code>config/general.php</code>, but I don't really want to do that from a security POV)</em></p>
  
  <p>Notes:</p>
  
  <ul>
  <li>This is on a site running Craft 3.3.13 (latest at time of writing)</li>
  <li>It's in a load-balanced environment</li>
  <li>We're using nginx as our webserver</li>
  </ul>
  
Tags: <craft3><session><logs><debugging>
Title: How can I debug `craft\web\User::_validateUserAgentAndIp()` warnings
ThreadText: # How can I debug `craft\web\User::_validateUserAgentAndIp()` warnings
  
  (Asked by: username_0 on 2019-10-31)
  
  On a production site, we're seeing a ton of the following warning in our `web.log` files for (seemingly) every request, creating a ton of noise in the logs and making it hard to spot "real" issues:
  
  ```
  <DATE> [-][-][-][warning][craft\web\User::_validateUserAgentAndIp] Request didn’t meet the user agent and IP requirement for maintaining a user session.
  
  ```
  
  [Under the hood](https://github.com/craftcms/cms/blob/004ab9ede036aa22bddd3f2b472c16e11bd8d55d/src/web/User.php#L536-L550) `craft\web\User::_validateUserAgentAndIp()` does the following
  
  ```
  private function _validateUserAgentAndIp(): bool
  {
      if (!Craft::$app->getConfig()->getGeneral()->requireUserAgentAndIpForSession) {
          return true;
      }
      $request = Craft::$app->getRequest();
      if ($request->getUserAgent() === null || $request->getUserIP() === null) {
          Craft::warning('Request didn’t meet the user agent and IP requirement for maintaining a user session.', __METHOD__);
          return false;
      }
      return true;
  }
  
  ```
  
  As far as I can see, (for front end templates at least) `craft.app.request.userAgent` and `craft.app.request.userIP` are correctly populated with the UA and IP respectively, so I'm not sure why/how Craft is throwing this warning.
  
  We don't see the same issue in dev / staging environments, so I know this is likely to be a configuration issue, but I'm asking this question to try and understand what's going on so I have some idea of what to look for.
  
  Question:
  
  * What should I look for / how can I debug what's causing this issue?
  
  *(Note: I know I could turn `requireUserAgentAndIpForSession` off in `config/general.php`, but I don't really want to do that from a security POV)*
  
  Notes:
  
  * This is on a site running Craft 3.3.13 (latest at time of writing)
  * It's in a load-balanced environment
  * We're using nginx as our webserver
  
  **Tags:** craft3, session, logs, debugging
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-10-31. Score: 1
  
  Most likely since it's a production site, it's from bots/scripts hitting the site's login page probing for vulnerabilities.
  
  I'd suggest changing the [cpTrigger](https://docs.craftcms.com/v3/config/config-settings.html#cptrigger) config setting and see if the occurrences go down.
  
  > **Comments:**
  > **username_0**: Thanks username_1, but I'm not sure that's the case in this instance: for one thing we're already using a custom cpTrigger, plus the (very large) request volume and the timing / pattern of requests is such that it seems to match that of "real" traffic to the front end of the site. Is there a way to see what path is being hit when the warning is triggered? I can't see anything in the dump of `$_SERVER` in the log output  
  > **username_1**: Hrm... devMode would log a bunch more info to help you track it down, but you probably don't want to enable that on production.  You could do a quick module/plugin that had a custom log target (could still be file based) where you log whatever information you want regardless of devMode.  
  > **username_0**: That's a good idea - thanks username_1, I'll give it a go and update here with an answer when I figure it out  
  > **username_3**: Tom - has there been an update on this on your end?  I've been seeing similar issues on a production site to this and am also trying to find a good starting point for trying to troubleshoot.  
  > **username_0**: @username_3 not yet - it's still in my backlog, just not at the top. My plan is to use a custom module to log out to a custom file some of the stuff we'd otherwise get from having `devMode` on, and use that to inspect exactly what Craft / PHP is seeing in the request.  
  > **username_2**: I've noticed this too recently on a couple of C3 sites.  
  
  ---
  
  