Parse Error: Invalid header value char

[cirrusflyer]

Removed old Docker image and setup latest 1.0.1. Added a check to a website that was successfully being checked prior. Getting this error:

Parse Error: Invalid header value char

Have another site that's still working fine. So this error is new with this new version.

[louislam]

I think it caused by invalid http response header rather than 1.0.1 itself, because 1.0.1 just added User-Agent and nothing else in this part.

Related issue:
nodejs/node#27711

[cirrusflyer]

Thanks. I wonder why it was working fine in earlier version.

[cirrusflyer]

I see the Incapsula WAF reference here as well, which is what we use. Any way to make the changes others are suggesting to resolve this issue?

[gufastian]

Getting the same issue on apparently well configured websites.

[adumont]

Same issue here for some webs (also a web protected by Incapsula ... btw)

[louislam]

You should report to Incapsula, because they are corrupted your http header.
Uptime Kuma here to tell your that.

[cirrusflyer]

Just an update. I spoke with Incapsula (Imperva) and they stated this:

"I suspect that this is being caused by our client classification cookie, which is a malformed cookie by design...The client classification cookie is just one of many different client classification methods that we use, so disabling it will not increase the security risk towards the site."

I also know that Uptime Robot, OhDear!, and others don't have this issue. What's unique about Kuma?

[simmessa]

Hi there,

for the people coming here for a fix I just wanted to add that if you're running uptime-kuma in docker container and you see this issue (maybe you're unlucky enough to be forced to monitor resources behing incapsula malformed cookies) you can quickly fix by launching the docker container with --insecure-http-parser like this:

docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1 node --insecure-http-parser server/server.js

Please make sure the --insecure-http-parser goes before the js file for this to work.

Hope it's useful to you all.

p.s.:
Please do some research on the security implications of using that --insecure-http-parser switch, there's more here: https://nodejs.org/docs/latest-v12.x/api/cli.html#cli_insecure_http_parser

[adumont]

Just tested, --insecure-http-parser switch working for me. Thanks (I do have some sites behind Imperva Incapsula)

[henkisdabro]

Thanks @simmessa for the solution, much appreciated! Would it be possible to implement some type of "disregard malformed cookies" option on per-monitor level? That way we don't need to make the entire Uptime Kuma instance parse insecure HTTP headers, but rather only when really necessary.

[mitin20]

works perfectly behind imperva-incapsula sites using docker thanks!!! @simmessa @adumont

BTW any idea how to include --insecure-http-parser on kubernetes manifest

[3deep5me]

@mitin20 check this spec out on a k8s deployment:

spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: uptime-kuma
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: uptime-kuma
    spec:
      containers: #use this down here
      - command:
        - node
        - --insecure-http-parser
        - server/server.js
        

[louislam]

Using environment variable should be easier in Docker/K8s.

NODE_OPTIONS=--insecure-http-parser

[MrCaringi]

Hi there,

for the people coming here for a fix I just wanted to add that if you're running uptime-kuma in docker container and you see this issue (maybe you're unlucky enough to be forced to monitor resources behing incapsula malformed cookies) you can quickly fix by launching the docker container with --insecure-http-parser like this:

docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1 node --insecure-http-parser server/server.js

Thanks it worked for my docker-compose too:

    command:
      - node
      - --insecure-http-parser
      - server/server.js

[bamhm182]

Just chiming in here to say I too would like to see the ability to implement this on a per-monitor level as well.