5

I'm using shared hosting with minimal access to any configuration settings.

I've created a more or less empty HTML file, emptypage.html, with the following contents:

<!DOCTYPE html>
<html>
<body>

</body>
</html>

When I pass an encoded URL as a query string parameter, I get a 403 error from the server.

Example URL:

http://example.com/emptypage.html?u=http%3A%2F%2Fexample%2Eorg

However, if the encoded URL is for the same domain, the page displays normally.

Example URL:

http://example.com/emptypage.html?u=http%3A%2F%2Fexample%2Ecom

Similarly, if the 'h' from the beginning of the URL is removed, the page displays normally.

Example URL:

http://example.com/emptypage.html?u=ttp%3A%2F%2Fexample%2Eorg

Could this be the result of some web server setting that I may be able to override in my local .htaccess file? My web host uses Apache (not sure which version).

NOTE: I asked a similar question earlier but it was not well understood and was put on hold. I've since done more research to figure out what exact conditions are yielding this issue.

Improve this question
4
  • 2
    You should not get a 403 on a parameter value. I would rather suspect that there is something in the server configuration that is causing this. Perhaps some security code to prevent XSS cross site scripting or database insertion code. I would suggest talking to your host's tech support. You may have to ask for a supervisor if you are not getting anywhere. This should never happen. Interesting question. I will up-vote it to give you some attention and see if anyone has ideas that may help.
    – closetnoc
    Mar 1, 2015 at 0:52
  • 2
    This sounds like a mod_security issue. This specifically blocks certain URL patterns - like the above - to guard against potential XSS attacks (as @closetnoc suggests).
    – MrWhite
    Mar 2, 2015 at 9:59
  • @w3d do you know if it is possible to override mod_security settings locally?
    – intuited
    Mar 3, 2015 at 0:11
  • 2
    Maybe, but this will depend on your host. Some hosts allow you to enable/disable mod_security via cPanel. However your host should be able to easily confirm whether this is the cause of the problem.
    – MrWhite
    Mar 3, 2015 at 9:40

1 Answer 1

Reset to default
2

Check .htaccess files to see if theres anything in it causing a 403.

Also ask the server admin to check httpd.conf (apache's configuration file) to see if that has anything referencing error 403.

And finally, a special module might be installed that blocks out certain URLs.

And the file extension should be anything but .html if you're adding on query strings because html pages are static pages. (pages that don't change based on parameters).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.