1

I use ajax (POST) in javascript to send text data to be saved as a file on the server by a php program (which simply does an fopen, fwrite and fclose). This generally works OK.

However recently I have had some data where this process has resulted in a 403 Forbidden error. After much analysis I have found that if the data includes the characters 'having a ?' then the error occurs. But if I eg remove the 'h' or the '?' then no error occurs. I cannot see any spurious characters in the data.

How can the content of the data uploaded affect whether the 403 error occurs or not?

Edit

I know something about programming, but very little about the WebServer environment. I only have FTP access to the server.

When the 403 occurs the error function from my AJAX call is getting triggered, so an alert tells me it has failed, and it shows in the console:

  • xhr.status: 403
  • xhr.responseText: [HTML code with title 403 Forbidden; body heading Forbidden, and text: You don't have permission to access /ShowMapsDev/savetext.php on this server. Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request]
  • thrownError: Forbidden

A little bit more on the behaviour:

It seems very reproducible as I have moved the code and data to a Test environment (on the same server) and I get the same behaviour (ie any data with exactly "having a ?" gives a 403 error, but without it there is no error).

I did have a similar problem a few months ago, but the triggering string was different ("Descri"). I needed to get on with my project, so having identified the issue I did a Kluge (altered the specific text). That string does NOT seem to trigger the 403 issue now.

I do have a .htaccess file, but that is unchanged for quite a while and just has rewrite rules to change http to https, to allow a shortened form of URL, and some entries generated by the Pretty URLs mod of SMF. I cannot see any of these causing my issue.

Improve this question
6
  • 1
    At what point is the 403 occurring? Is the request getting to your script at all? Is your script sending a response? Or is this an immediate 403 from your server? Server error? Custom error response? Anything in your error log? mod_security rule being triggered? – DocRoot Jun 18 '18 at 7:23
  • Are you using a firewall or other security product? – Stephen Ostermiller♦ Jun 18 '18 at 10:50
  • Thanks for the responses. @DocRoot: There is nothing in the site's error_log file. I don't know how to tell if a mod_security rule is being triggered. I don't think it is an immediate 403 from the server, as the error function from my AJAX call is getting triggered (see my edit above). – Peter Cooper Jun 19 '18 at 4:32
  • @Stephen: I am running BitDefender on my PC and have tried turning it off but this does not seem to change the behaviour. I don't know what is on the server, and have no control over it. – Peter Cooper Jun 19 '18 at 4:34
  • Do you have access to the error_log on the server? It looks like a standard Apache message, so having access to the error_log or asking your host to look into it sound like the only ways to solve this issue. – Stephen Ostermiller♦ Jun 19 '18 at 9:33
2

Apparently we use a shared hosting server as part of our package, so we cannot see the apache logs. However the host did eventually check the logs, and said "We have checked the Apache error logs and discovered that the issue has been caused by a triggered ModSecurity rule. ModSecurity has conflicts with some scripts and plugins which may result in false-positive blocks.

We have whiltelisted the triggered rule, but it is possible for other rules to be triggered on the website."

I have repeated the save that caused the 403 before, and I now get no error, so the immediate issue is solved, but I am no clearer how I can avoid such a problem in future. I will try to find out more.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.