XX-net/XX-Net · warning

web control ref:%s refuse

Error message

web control ref:%s refuse

What it means

A POST to the web control endpoint had a Referer whose netloc is neither 127.0.0.1 nor localhost, so it was refused as a cross-origin request. The typo 'startswitch' and bare except mean the check is effectively best-effort: on exception it falls through and allows the request.

Source

Thrown at code/default/gae_proxy/local/web_control.py:218

            data += b'\r\n'
            self.wfile.write(data)
            xlog.info('%s "%s %s HTTP/1.1" 200 -', self.address_string(), self.command, self.path)
        elif os.path.isfile(filename):
            if filename.endswith('.pac'):
                mimetype = 'text/plain'
            else:
                mimetype = 'application/octet-stream'
            #self.send_file(filename, mimetype)
        else:
            self.wfile.write(b'HTTP/1.1 404\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\n404 Not Found')
            xlog.info('%s "%s %s HTTP/1.1" 404 -', self.address_string(), self.command, self.path)

    def do_POST(self):
        try:
            refer = self.headers.getheader('Referer')
            netloc = urlparse(refer).netloc
            if not netloc.startswith("127.0.0.1") and not netloc.startswitch("localhost"):
                xlog.warn("web control ref:%s refuse", netloc)
                return
        except:
            pass

        xlog.debug ('GAEProxy web_control %s %s %s ', self.address_string(), self.command, self.path)

        path = urlparse(self.path).path
        if path == '/deploy':
            return self.req_deploy_handler()
        elif path == "/config":
            return self.req_config_handler()
        elif path == "/scan_ip":
            return self.req_scan_ip_handler()
        elif path.startswith("/importip"):
            return self.req_importip_handler()
        else:
            self.wfile.write(b'HTTP/1.1 404\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\n404 Not Found')
            xlog.info('%s "%s %s HTTP/1.1" 404 -', self.address_string(), self.command, self.path)

View on GitHub (pinned to cfa5bc17b6)

Solutions

  1. Access the control UI via http://127.0.0.1:port directly
  2. Ensure the browser sends the Referer header for same-origin POSTs
  3. Fix the bug: netloc.startswitch -> netloc.startswith so the check actually enforces localhost

Example fix

// before
if not netloc.startswith("127.0.0.1") and not netloc.startswitch("localhost"):
    xlog.warn("web control ref:%s refuse", netloc)
    return

// after
if not netloc.startswith("127.0.0.1") and not netloc.startswith("localhost"):
    xlog.warn("web control ref:%s refuse", netloc)
    return
Defensive patterns

Strategy: validation

Validate before calling

# call the control API only from same-origin pages on 127.0.0.1
url = 'http://127.0.0.1:%d/%s' % (port, endpoint)

Prevention

When it happens

Trigger: POSTing from a page served on a different host/port (Referer netloc mismatch), or with no Referer header (urlparse(None) raises and the except swallows it, so the request proceeds).

Common situations: Accessing the web UI via a non-loopback hostname or proxied domain; browser privacy settings stripping Referer (request passes due to the except); CSRF-hardening behavior in newer browsers.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/f421ad87841b0939. Report an issue: GitHub.