1

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget).

When I test to see what these kind of users see when accessing my website on each of these occasions, The error message that is displayed is something like:

"Forbidden

You don't have permission to access /images/ on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request."

The title is 403 error, but in my server logs I see that the server is returning a 404 error.

So - Is this "good" or "bad"? What does the above message means?

  • 1
    I understand how you set the -Indexes. What other things have you done to protect the images directory? The short answer is, there is nothing wrong, just two conflicting conditions. – closetnoc Apr 5 '14 at 0:26
  • nothing besides -indexes, should I do something else? (for the bad bots I had set a rewrite with F flag). what is conflicting what? doesn't a conflict means something isn't right? I'm trying to figure if it's bad,ok, or maybe even better that my server sends 404 even though the real error is 403 – getbuck Apr 5 '14 at 0:29
  • 1
    It has been a while since I have done some of this, but you are getting a 403 as you would expect, but it appears as though there is another condition likely in the .htaccess that is also causing a 404. One before the other. I do not think there is any harm, it is just not as pretty. – closetnoc Apr 5 '14 at 0:50
1

The 403 Forbidden error is due to the access denied issue as intended, there is no issue here - that seems fine.

The 404 Page Not Found error is due to your .htaccess file looking for and not finding where it expects, some kind of customised error page to show in this circumstance. It's possible your hosting provider may have this configured at the server-level rather than it being under your control. Your log file should actually show the file it is trying to find alongside the error.

If the ErrorDocument had not been specified in the .htaccess file then Apache would have simply used a default basic error page however since it has been specified you should ensure you have a file in place. Doing so will ensure:

  • (a) users are not led to believe your web-server/website might have other misconfiguration issues which could be exploited; and

  • (b) your log files won't be bloated with an extra 404 error for every 403 error (this may be particularly appreciated if you pay per megabyte of hosted disk-space, if you have a quota limit restricting your available disk-space, or if your logs work on a time-limit cycle, for example storing only the last 72 hours worth of log entries and removing older ones as newer entries are added).

If the ErrorDocument configuration requires you to have /403.html as your error file but you wish to use /errors/access-denied.php for example, then you could create an HTTP 301 redirect or rewrite rule in your .htaccess file to manage this.

  • 1
    301 redirecting won't work properly for error documents. That would cause the HTTP status to be 301 (redirect) rather than 403. ErrorDocument directives can be overridden, so putting in a second with the desired path would fix the problem better. – Stephen Ostermiller Apr 7 '14 at 11:00
  • There's no configuration for an error page in my .htaccess, and I can't see any file being requested in the server log, it just returns a 404 for the file the path originally requested, such as /images/ – getbuck Apr 10 '14 at 9:37
  • Stephen is right about the 301 redirection though you can specifiy a full URL next to the 403 instead of a relative path if you wish. Add a new line to the top of your .htaccess file then with ErrorDocument 403 /403.html and then create a 403.html file in your webroot folder with the error message you want to display such as "Access Denied". – richhallstoke Apr 11 '14 at 10:52
1

It looks like you probably setup the forbidden error document with 404 instead of 403. But unless you were to show us your .htaccess setup, it will be difficult for us to help you.

In regard to returning 404 instead of 403, I do that a lot. That's a way to not give away the fact that certain pages or directories exist. Say I have a "secret" path that only administrators can access, no one needs a 403 because no one except a very few people who can administrate the site and they probably need to log in before they can access that area of the site.

In your case, though, it may be less of a good idea. But the truth is that /images if not forbidden. It is just that you do not have a default index.html so returning 404 is probably better because a path such as /images/eiffel-tower.jpg would also be forbidden if the root directory is forbidden (at least with my logic.)

0

I think that your server can't find the error doc that you specified.

Further use a header checker to check the header, if its a 403 no problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.