php nginx server got strange header and post data from http request

Question

Our app server got some strange request, http headers like:

"Content-Type": "application/x-www-form-urlencoded",
"Content-Length": "3177",
"Host": "xxxxxxxxx",
"Accept": "*/*",
"Accept-Encoding": "gzip",
"Msisdn": "12345678",

And the http post body read using file_get_contents('php://input') was beginning with:ISDN: 12345678\r\n\r\n

The Msisdn entity header and ISDN: 12345678\r\n\r\n were not sent by out app client.

Our app written in cpp using libcurl to deal with http request. I really do not know what has happened now. Especially the ISDN: 12345678\r\n\r\n in post body content.

All suggestions are welcome.

Brookebrooker

Are you sure the request came from your application? – Fransis

ISDN is a mobile phone number, so I think that header is sent by mobile apps. – Fransis

Maybe proxy server on the mobile network is adding the header. But it shouldn't modify the post body. – Fransis

Not really sure the request came from my application, and out app runs on both iOS and Android, it happened dozens of times a day, – Brookebrooker

@Fransis proxy server maybe add headers, but the post body changed too. – Brookebrooker

That's completely invalid, but I'm not sure there's anything you can do about it. – Fransis

Now i could do nothing at all, the post body has been cut off, it cannot be properly decoded. – Brookebrooker

@zsounder libcurl will not modify your http request by its own accord. Anything your server receives is added either by the client or by some relayer in the network – Hasson

there's an interesting discussion here. Would the MSISDN header be set by a network provider if the client was using a mobile phone as a wifi hotspot? #8428922 – Dyan

Is the communication happening over HTTP or HTTPS? You should put it on back of HTTPS using Nginx or something and see if it helps – Pyrrha

@TarunLalwani its over HTTP – Brookebrooker

@Hasson agree with you, not a big deal to add MSISDN header, but seems the post body changed – Brookebrooker

@zsounder, I would suggest you put behind Nginx and protect it using HTTPS and see if that helps. Then may be you wont see such probelms – Pyrrha

@TarunLalwani We can not change to HTTPS for all requests for historic reasons. – Brookebrooker

Answer 1

Clients can add whatever headers they want, as can proxy servers. This header is added in by some mobile networks for all requests.

Detect an MSISDN (mobile number) with the browser

Kira

Not a big deal to add MSISDN Or calling-line-id, the thing is the post body had been changed too. – Brookebrooker

Then change to HTTPS so the data can't be changed by a MITM proxy on the wireless provider's side. – Kira

We can not change to HTTPS for all requests for historic reasons. – Brookebrooker

Then you are accepting that your traffic can be man in the middle'd and altered. And you're exposing every bit of data over this API to being read and modified in transit - which will cause more issues like this in the future. Your historic reasons will be biting you for the foreseeable future, but thats your project. – Kira