[GH-ISSUE #67] Console errors from web dashboard

kerem commented

2026-02-27 20:05:09 +03:00

Owner

Originally created by @tomballgithub on GitHub (Feb 18, 2026).
Original GitHub issue: https://github.com/misiektoja/instagram_monitor/issues/67

Used the web dashboard for the first time in a while. Just clicked between the different windows. Didn't select or change anything.

Came back to console and saw this:

192.168.1.88 - - [18/Feb/2026 15:22:19] code 400, message Bad request version ('\x00\x12\x00\x10\x04\x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x00')
192.168.1.88 - - [18/Feb/2026 15:22:19] code 400, message Bad request version ('æW\x00#\x00\x00\x00\x1b\x00\x03\x02\x00\x02\x00')
192.168.1.88 - - [18/Feb/2026 15:22:20] code 400, message Bad request version ('<ýI\x84w\x99À\x02»{¢õzËÈÂ!A:e\x8aª\x0fFM?\x8b°|aræ\x0e\x02÷K¼CIk°\x07Qö')
192.168.1.88 - - [18/Feb/2026 15:22:20] code 400, message Bad request version ('zz\x13\x01\x13\x02\x13\x03À+À/À,À0Ì©Ì¨À\x13À\x14\x00\x9c\x00\x9d\x00/\x005\x01\x00\x06sJJ\x00\x00\x00\x1b\x00\x03\x02\x00\x02\x00')

Originally created by @tomballgithub on GitHub (Feb 18, 2026). Original GitHub issue: https://github.com/misiektoja/instagram_monitor/issues/67 Used the web dashboard for the first time in a while. Just clicked between the different windows. Didn't select or change anything. Came back to console and saw this: ``` 192.168.1.88 - - [18/Feb/2026 15:22:19] code 400, message Bad request version ('\x00\x12\x00\x10\x04\x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x00') 192.168.1.88 - - [18/Feb/2026 15:22:19] code 400, message Bad request version ('æW\x00#\x00\x00\x00\x1b\x00\x03\x02\x00\x02\x00') 192.168.1.88 - - [18/Feb/2026 15:22:20] code 400, message Bad request version ('<ýI\x84w\x99À\x02»{¢õzËÈÂ!A:e\x8aª\x0fFM?\x8b°|aræ\x0e\x02÷K¼CIk°\x07Qö') 192.168.1.88 - - [18/Feb/2026 15:22:20] code 400, message Bad request version ('zz\x13\x01\x13\x02\x13\x03À+À/À,À0Ì©Ì¨À\x13À\x14\x00\x9c\x00\x9d\x00/\x005\x01\x00\x06sJJ\x00\x00\x00\x1b\x00\x03\x02\x00\x02\x00') ```

kerem closed this issue

2026-02-27 20:05:10 +03:00

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@misiektoja commented on GitHub (Feb 20, 2026):

Do you remember what you were doing in the web UI when those errors appeared?

@misiektoja commented on GitHub (Feb 20, 2026): Do you remember what you were doing in the web UI when those errors appeared?

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 20, 2026):

I didn't do anything except click through the tab on the left. I was unable to reproduce.

I hoped that decoding the log messages would identify the issue or narrow it down.

@tomballgithub commented on GitHub (Feb 20, 2026): I didn't do anything except click through the tab on the left. I was unable to reproduce. I hoped that decoding the log messages would identify the issue or narrow it down.

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 20, 2026):

FWIW, Claude says the following.
However, I wouldn't have tried to use HTTPS because I have an existing HTTP tab that I just refresh.
I tried refreshing, clicking around again, and using HTTPS.
Nothing reproduced the messages

What's Happening

Your Python HTTP server is receiving HTTPS/TLS traffic on a plain HTTP port. Something (a client, browser, or scanner) is trying to connect with SSL/TLS but your server only speaks HTTP.

Decoding the \x?? bytes

These aren't arbitrary garbage — they're TLS Client Hello handshake messages. Let me break down the key parts:
Line 1: \x00\x12\x00\x10\x04\x03\x08\x04\x04\x01\x05\x03...

This is a TLS ALPN extension (Application-Layer Protocol Negotiation)
The cipher suite bytes (\x04\x03, \x08\x04, \x04\x01, etc.) are standard TLS 1.2/1.3 cipher identifiers

Line 4: zz\x13\x01\x13\x02\x13\x03À+À/...

\x13\x01 = TLS_AES_128_GCM_SHA256 (TLS 1.3)
\x13\x02 = TLS_AES_256_GCM_SHA384 (TLS 1.3)
\x13\x03 = TLS_CHACHA20_POLY1305_SHA256 (TLS 1.3)
À+ / À/ = ECDHE-ECDSA / ECDHE-RSA cipher suites (TLS 1.2)
zz at the start is a GREASE value — Chrome/Firefox inject these to test server tolerance, which strongly suggests this is a browser hitting your server

Line 3: The longer binary blob is likely the TLS session ticket or key exchange data

The Root Cause

Your server is running plain HTTP, but a client is sending HTTPS. Python's BaseHTTPServer/http.server rejects this with Bad request version because the TLS handshake bytes don't look like a valid HTTP method/version string.

Fixes (I know they don't apply here, just listing for completeness)

Option 1 — Wrap your server with SSL (if you want HTTPS):

pythonimport ssl
httpd.socket = ssl.wrap_socket(httpd.socket, 
    certfile='cert.pem', 
    keyfile='key.pem', 
    server_side=True)

Option 2 — Check your client and make sure it's using http:// not https:// when connecting to this server.

Option 3 — Use a reverse proxy like nginx or Caddy in front that handles TLS termination.
The IP 192.168.1.88 is local, so this is likely a browser or internal tool on your network that auto-upgrades to HTTPS (HSTS, or just typed https:// by habit).

@tomballgithub commented on GitHub (Feb 20, 2026): FWIW, Claude says the following. However, I wouldn't have tried to use HTTPS because I have an existing HTTP tab that I just refresh. I tried refreshing, clicking around again, and using HTTPS. Nothing reproduced the messages ### What's Happening Your Python HTTP server is receiving HTTPS/TLS traffic on a plain HTTP port. Something (a client, browser, or scanner) is trying to connect with SSL/TLS but your server only speaks HTTP. ### Decoding the \x?? bytes These aren't arbitrary garbage — they're TLS Client Hello handshake messages. Let me break down the key parts: Line 1: \x00\x12\x00\x10\x04\x03\x08\x04\x04\x01\x05\x03... This is a TLS ALPN extension (Application-Layer Protocol Negotiation) The cipher suite bytes (\x04\x03, \x08\x04, \x04\x01, etc.) are standard TLS 1.2/1.3 cipher identifiers Line 4: zz\x13\x01\x13\x02\x13\x03À+À/... \x13\x01 = TLS_AES_128_GCM_SHA256 (TLS 1.3) \x13\x02 = TLS_AES_256_GCM_SHA384 (TLS 1.3) \x13\x03 = TLS_CHACHA20_POLY1305_SHA256 (TLS 1.3) À+ / À/ = ECDHE-ECDSA / ECDHE-RSA cipher suites (TLS 1.2) zz at the start is a GREASE value — Chrome/Firefox inject these to test server tolerance, which strongly suggests this is a browser hitting your server Line 3: The longer binary blob is likely the TLS session ticket or key exchange data ### The Root Cause Your server is running plain HTTP, but a client is sending HTTPS. Python's BaseHTTPServer/http.server rejects this with Bad request version because the TLS handshake bytes don't look like a valid HTTP method/version string. ### Fixes (I know they don't apply here, just listing for completeness) Option 1 — Wrap your server with SSL (if you want HTTPS): ``` pythonimport ssl httpd.socket = ssl.wrap_socket(httpd.socket, certfile='cert.pem', keyfile='key.pem', server_side=True) ``` Option 2 — Check your client and make sure it's using http:// not https:// when connecting to this server. Option 3 — Use a reverse proxy like nginx or Caddy in front that handles TLS termination. The IP 192.168.1.88 is local, so this is likely a browser or internal tool on your network that auto-upgrades to HTTPS (HSTS, or just typed https:// by habit).

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 20, 2026):

Even if it was HTTPS, would be nice to mask those errors or put them only into the LOG

@tomballgithub commented on GitHub (Feb 20, 2026): Even if it was HTTPS, would be nice to mask those errors or put them only into the LOG

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 21, 2026):

These errors are not in the log, so I believe they are being printed outside of the script.

@tomballgithub commented on GitHub (Feb 21, 2026): These errors are not in the log, so I believe they are being printed outside of the script.

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 21, 2026):

All signs point to something trying to touch the web dashboard using SSL and that is an expected printout from flash. There's a way to mask it, but it's not worth it.

This could have been a coincidence rather than related to my clicking on the dashboard. Seems unlikely, but it's a possibility

CANNOT DUPLICATE...

@tomballgithub commented on GitHub (Feb 21, 2026): All signs point to something trying to touch the web dashboard using SSL and that is an expected printout from flash. There's a way to mask it, but it's not worth it. This could have been a coincidence rather than related to my clicking on the dashboard. Seems unlikely, but it's a possibility CANNOT DUPLICATE...

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@misiektoja commented on GitHub (Feb 24, 2026):

I was able to replicate it via openssl:

openssl s_client -connect 127.0.0.1:8000

In the console I got sth similar to yours:

127.0.0.1 - - [24/Feb/2026 01:45:50] code 400, message Bad request version ("4y£\x92gäà²='\x06\x00<\x13\x02\x13\x03\x13\x01À,À0\x00\x9fÌ©Ì¨ÌªÀ+À/\x00\x9eÀ$À(\x00kÀ#À'\x00gÀ")

I suppressed noisy TLS-on-HTTP 400 parse logs in 469e1c163d.

@misiektoja commented on GitHub (Feb 24, 2026): I was able to replicate it via openssl: ``` openssl s_client -connect 127.0.0.1:8000 ``` In the console I got sth similar to yours: `127.0.0.1 - - [24/Feb/2026 01:45:50] code 400, message Bad request version ("4y£\x92gäà²='\x06\x00<\x13\x02\x13\x03\x13\x01À,À0\x00\x9fÌ©Ì¨ÌªÀ+À/\x00\x9eÀ$À(\x00kÀ#À'\x00gÀ")` I suppressed noisy TLS-on-HTTP 400 parse logs in 469e1c163d47.

kerem commented

2026-02-27 20:05:10 +03:00

Author

Owner

@tomballgithub commented on GitHub (Feb 24, 2026):

I tried virtually everything except openssl (I didn't have it installed). Great news!

@tomballgithub commented on GitHub (Feb 24, 2026): I tried virtually everything except openssl (I didn't have it installed). Great news!

Rows
Columns

[GH-ISSUE #67] Console errors from web dashboard #51

What's Happening

Decoding the \x?? bytes

The Root Cause

Fixes (I know they don't apply here, just listing for completeness)