--- title: Bad requests and the dream of a quiet Rails app | daily.dev description: Production Rails apps get hit constantly with garbage requests from scanners and bots, which raise a grab-bag of exceptions in monitoring tools like Sentry or... canonical: https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bad requests and the dream of a quiet Rails app | daily.dev og:description: Production Rails apps get hit constantly with garbage requests from scanners and bots, which raise a grab-bag of exceptions in monitoring tools like Sentry or... og:url: https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i og:image: https://api.daily.dev/og/posts/8wO1AES4I.png og:image:alt: Bad requests and the dream of a quiet Rails app og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bad requests and the dream of a quiet Rails app **[RUBYLAND](https://daily.dev/sources/rubyla)** · 5 min read · 0 upvotes · 0 comments ## Summary Production Rails apps get hit constantly with garbage requests from scanners and bots, which raise a grab-bag of exceptions in monitoring tools like Sentry or AppSignal. The goal is turning 500 errors ('it broke') into handled 400 errors ('lol no') that don't trigger alerts. Where an exception is raised in the Rack middleware stack relative to ActionDispatch::ShowExceptions determines whether it becomes a 500 or 400. Recent PHP2Shell vulnerability scans triggered a new Rack::Multipart::BoundaryTooLongError. The author suggests building custom middleware like MalformedRequestHandler and notes LLMs now make it easier to diagnose which exception raised what, and find relevant upstream Rails/Rack issues. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my Rails app throw a 500 error for a malformed request instead of a 400? It depends on where in the Rack middleware stack the exception is raised relative to ActionDispatch::ShowExceptions. Any exception raised earlier or higher than ActionDispatch::ShowExceptions, closer to Puma, typically becomes a 500 response, while exceptions raised later or lower in the stack typically become a 400 response instead. _Developers chasing noisy error alerts can track Rails and Rack middleware fixes on daily.dev._ ### What exception does Rack raise for the BoundaryTooLongError multipart vulnerability scans? Scans exploiting the PHP2Shell vulnerability can trigger Rack::Multipart::BoundaryTooLongError, raised when multiple boundary parameters are found in a multipart content type. An unreleased Rack version includes a fix for this, and an unmerged Rails pull request would also improve handling of it. _Teams hardening Rails apps against scanner traffic can follow Rack and Rails patches on daily.dev._ ### How can I stop exception monitoring tools like Sentry from alerting on garbage bot requests to my Rails app? Build custom middleware, often named something like MalformedRequestHandler, placed at the top of the Rack stack to catch and convert these exceptions into handled 400 responses before they reach the monitoring tool. Sentry also maintains a default exception ignore list to suppress known non-exceptional errors from being reported. _Rails developers tuning alert noise can keep up with middleware patterns like this on daily.dev._ ## Similar posts on daily.dev - [How bot scans used up my Rollbar quota and triggered New Relic alerts](https://daily.dev/posts/how-bot-scans-used-up-my-rollbar-quota-and-triggered-new-relic-alerts-u6caqli6x) · Ruby Flow · 0 upvotes · 0 comments - [GHSA-42qh-8mx8-7wqm \(rack-proxy\): HTTP response smuggling via ambiguous backend response framing in rack-proxy 1.x](https://daily.dev/posts/ghsa-42qh-8mx8-7wqm-rack-proxy-http-response-smuggling-via-ambiguous-backend-response-framing-in--dgy8hoi4b) · RUBYLAND · 0 upvotes · 0 comments - [GitHub Reworks Layered Defenses After Legacy Protections Block Legitimate Traffic](https://daily.dev/posts/github-reworks-layered-defenses-after-legacy-protections-block-legitimate-traffic-rx7vxwf8q) · InfoQ · 0 upvotes · 0 comments - [Post Mortem: HTTP Request Smuggling Vulnerability](https://daily.dev/posts/post-mortem-http-request-smuggling-vulnerability-36fsdzezd) · Crystal · 7 upvotes · 0 comments - [Debugging on Prod](https://daily.dev/posts/debugging-on-prod-piztjksny) · Ibrahim Diallo · 3 upvotes · 0 comments --- Tags: [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bad requests and the dream of a quiet Rails app","url":"https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i"},"datePublished":"2026-10-28T16:25:07.489Z","dateModified":"2026-10-28T16:34:56.267Z","description":"Production Rails apps get hit constantly with garbage requests from scanners and bots, which raise a grab-bag of exceptions in monitoring tools like Sentry or...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"rails","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"Bad requests and the dream of a quiet Rails app"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bad-requests-and-the-dream-of-a-quiet-rails-app-8wo1aes4i#faq","mainEntity":[{"@type":"Question","name":"Why does my Rails app throw a 500 error for a malformed request instead of a 400?","acceptedAnswer":{"@type":"Answer","text":"It depends on where in the Rack middleware stack the exception is raised relative to ActionDispatch::ShowExceptions. Any exception raised earlier or higher than ActionDispatch::ShowExceptions, closer to Puma, typically becomes a 500 response, while exceptions raised later or lower in the stack typically become a 400 response instead. Developers chasing noisy error alerts can track Rails and Rack middleware fixes on daily.dev."}},{"@type":"Question","name":"What exception does Rack raise for the BoundaryTooLongError multipart vulnerability scans?","acceptedAnswer":{"@type":"Answer","text":"Scans exploiting the PHP2Shell vulnerability can trigger Rack::Multipart::BoundaryTooLongError, raised when multiple boundary parameters are found in a multipart content type. An unreleased Rack version includes a fix for this, and an unmerged Rails pull request would also improve handling of it. Teams hardening Rails apps against scanner traffic can follow Rack and Rails patches on daily.dev."}},{"@type":"Question","name":"How can I stop exception monitoring tools like Sentry from alerting on garbage bot requests to my Rails app?","acceptedAnswer":{"@type":"Answer","text":"Build custom middleware, often named something like MalformedRequestHandler, placed at the top of the Rack stack to catch and convert these exceptions into handled 400 responses before they reach the monitoring tool. Sentry also maintains a default exception ignore list to suppress known non-exceptional errors from being reported. Rails developers tuning alert noise can keep up with middleware patterns like this on daily.dev."}}]} ```