I've got a well-established web application. It's working for lots of people with a variety of browsers and platforms. But, there's this one guy...
He's getting a "403 Forbidden" on his side, I've even seen screen shots. But, I'm not logging anything in Apache or Tomcat that seems to indicate that he's actually been denied. I know he's authenticating because I see it explicitly. This, combined with the fact that he's the only broken user makes me wonder.
Can a browser (IE in this case) ever decide on its own to throw a 403 that's not actually generated by the server?
P.S.: I don't have rep to create '403' tag, but it's probably appropriate.