On a production site, we're seeing a ton of the following warning in our web.log files for (seemingly) every request, creating a ton of noise in the logs and making it hard to spot "real" issues:

<DATE> [-][-][-][warning][craft\web\User::_validateUserAgentAndIp] Request didn’t meet the user agent and IP requirement for maintaining a user session.

Under the hood craft\web\User::_validateUserAgentAndIp() does the following

private function _validateUserAgentAndIp(): bool
    if (!Craft::$app->getConfig()->getGeneral()->requireUserAgentAndIpForSession) {
        return true;
    $request = Craft::$app->getRequest();
    if ($request->getUserAgent() === null || $request->getUserIP() === null) {
        Craft::warning('Request didn’t meet the user agent and IP requirement for maintaining a user session.', __METHOD__);
        return false;
    return true;

As far as I can see, (for front end templates at least) craft.app.request.userAgent and craft.app.request.userIP are correctly populated with the UA and IP respectively, so I'm not sure why/how Craft is throwing this warning.

We don't see the same issue in dev / staging environments, so I know this is likely to be a configuration issue, but I'm asking this question to try and understand what's going on so I have some idea of what to look for.


  • What should I look for / how can I debug what's causing this issue?

(Note: I know I could turn requireUserAgentAndIpForSession off in config/general.php, but I don't really want to do that from a security POV)


  • This is on a site running Craft 3.3.13 (latest at time of writing)
  • It's in a load-balanced environment
  • We're using nginx as our webserver

1 Answer 1


Most likely since it's a production site, it's from bots/scripts hitting the site's login page probing for vulnerabilities.

I'd suggest changing the cpTrigger config setting and see if the occurrences go down.

  • Thanks Brad, but I'm not sure that's the case in this instance: for one thing we're already using a custom cpTrigger, plus the (very large) request volume and the timing / pattern of requests is such that it seems to match that of "real" traffic to the front end of the site. Is there a way to see what path is being hit when the warning is triggered? I can't see anything in the dump of $_SERVER in the log output
    – Tom Davies
    Oct 31, 2019 at 21:45
  • Hrm... devMode would log a bunch more info to help you track it down, but you probably don't want to enable that on production. You could do a quick module/plugin that had a custom log target (could still be file based) where you log whatever information you want regardless of devMode.
    – Brad Bell
    Nov 2, 2019 at 0:40
  • That's a good idea - thanks Brad, I'll give it a go and update here with an answer when I figure it out
    – Tom Davies
    Nov 5, 2019 at 13:33
  • Tom - has there been an update on this on your end? I've been seeing similar issues on a production site to this and am also trying to find a good starting point for trying to troubleshoot.
    – gjhead
    Nov 20, 2019 at 15:48
  • @gjhead not yet - it's still in my backlog, just not at the top. My plan is to use a custom module to log out to a custom file some of the stuff we'd otherwise get from having devMode on, and use that to inspect exactly what Craft / PHP is seeing in the request.
    – Tom Davies
    Nov 26, 2019 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.