How to silence ActionController::UnknownHttpMethod errors?

Question

On my Rails production website I sometimes get a dozen or so errors along the lines of:

An ActionController::UnknownHttpMethod occurred in #:

TRACK, accepted HTTP methods are OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, VERSION-CONTROL, REPORT, CHECKOUT, CHECKIN, UNCHECKOUT, MKWORKSPACE, UPDATE, LABEL, MERGE, BASELINE-CONTROL, MKACTIVITY, ORDERPATCH, ACL, SEARCH, MKCALENDAR, and PATCH

I guess this is when bots hit my site with HTTP methods that Rails can't handle (in my case it's mostly OPENVAS, TRACK, DEBUG, TRACK, and INDEX but also weird methods like WMIXLVXM).

Is there a way to silence these messages in any way? I am still unsure as to whether this is a Rails issue or an Nginx issue.

I am using a custom controller to render custom error pages to the user:

Rails.application.routes.draw do

  %w(404 500).each do |status|
    match status, :to => 'errors#show', :status => status, :via => :all
  end

  ...

end

---

class ErrorsController < ApplicationController

  def show
    status = params[:status] || 500
    @title = "Error"
    render(:status => status, :template => "errors/show.html.erb")
  end

end

But my custom controller is probably not causing the errors?

Thanks for any help.

Answer 1

Since these are requests that you are not going to handle anyway, better way is to limit https methods at nginx level, so that these will not hit rails at all:

server {
  # (your vhost for this app)

  if ($request_method !~ ^(GET|HEAD|PUT|POST|DELETE|OPTIONS|PATCH)$ ){
    return 405;
  }
}

Answer 2

Actually, what bothers me the most is the Exception Notifications I am getting from Rails when a bot hits my site with an unknown HTTP method. (Sometimes I get a dozen or so exception emails à la An ActionController::UnknownHttpMethod occurred in ... within a matter of seconds.)

So in my production.rb I added one extra line:

  config.middleware.use ExceptionNotification::Rack,
    :ignore_exceptions => ['ActionController::UnknownHttpMethod'] + ExceptionNotifier.ignored_exceptions, # I added this line
    :email => {
      :email_prefix => "[ERROR]",
      :sender_address => %{"Error Notification" <[email protected]>},
      :exception_recipients => %w{[email protected]}
    }

Let's see how that works out. I will post updates in a few weeks.