[squid-users] grove.microsoft.com

[Amos Jeffries]

> On Fri, Apr 15, 2016 at 4:04 PM, Michael Pelletier wrote:
> 
>> I am blocking grove.microsoft.com. Even though I am blocking it, I am
>> seeing large, 2 Gig, uploads from the client to the proxy (which indeed
>> blocks it). It is almost like the connection request (explicit) contains
>> the 2 gig post request. Why is this happening? Has anyone seen this?
>>

On 15/04/2016 4:57 p.m., Jason Haar wrote:
> If you are blocking it, then it can't be uploading 2G? How are you
> measuring that it uploads 2G? Did you change squid's logging to support
> that (it doesn't log upload sizes - only download sizes by default). Are
> you simply referring to the Content-Length header - as that would say 2G -
> even if the upload is then blocked.


Also, you may be completely misunderstanding what you have configured.

Once a request starts it must be finished. There are only two ways to
finish requests in HTTP/1.1 and one of those ways is to absorb and
discard any payload that exists on the request message. Which matches
your description perfectly.


We will need to see how you have 'blocked' the traffic and what the
message headers going through contain.

Amos