What about /favicon.ico - or those pre-flight requests? The only real way to refuse requests is to just close the connection, no 404s or whatever should be sen

What about /favicon.ico - or those pre-flight requests? The only real way to refuse requests is to just close the connection, no 404s or whatever should be sent. The deal with the way most people have designed the web from a client point of view, a lot of it works by convention - that's where this stuff starts to break. cgi-bin was a fairly well accepted convention a couple decades ago - and today those URIs are considered malicious. Unless people start depreciating conventions sooner, this problem will have false positives of its own.