3

I've read all the 403-related questions here and elsewhere and I can't find an answer to this question: When I try to get a particular image on a remote domain via JavaScript I get a 403 error. But if I type the same exact image URL in the same browser, the image is downloaded and displayed without errors. Same (success) if I try getting it via PHP.

Here is a fiddle with a live example of the 403 (visible in the debug console): http://jsfiddle.net/8VfrQ/ Then, just copy and paste the img.src link in the browser and you'll see the star displayed.

Thanks for any hints.

Improve this question
3
  • When I open that image by clicking on it, it also returns a 403 forbidden.
    – Nzall
    Jun 25, 2014 at 13:58
  • What do you mean by "clicking on it"?
    – chris
    Jun 25, 2014 at 15:03
  • I got a chrome plugin that automatically makes valid urls clickable. sometimes I forget not everyone has that. I clicked that URL in the jsfiddle and it showed a 403 forbidden at the time I clicked it. It works fine now, so I don't know what caused it.
    – Nzall
    Jun 25, 2014 at 15:06

2 Answers 2

Reset to default
6

When I try to get a particular image on a remote domain via JavaScript I get a 403 error.

Likely answer: The site in question has protection against "leeching" / hotlinking. i.e. It checks to see what host is requesting the file before serving it. If the request comes from an unrecognised website, they throw a 403 Forbidden error.

If you take a look at this updated fiddle you will see that it's not only JavaScript that is affected.

Improve this answer
3
  • Ah! But if you put the url in the browser you can get it, right? How can the server know if it's an img request vs a browser one?
    – chris
    Jun 25, 2014 at 15:02
  • @IlmariKaronen: That should return an error 406. 403 means "The request was a valid request, but the server is refusing to respond to it", so if the server decides for any reason to refuse to respond, 403 is appropriate.
    – gnasher729
    Jun 25, 2014 at 15:38
  • But what if some time it shows forbidden and sometime allows and renders image successfully....I am facing this issue.The site sometime return forbidden error but some time successfully file loads..
    – Sadaquat
    Nov 11, 2016 at 7:15
3

The site appears to be checking the referrer field.

curl -I http://mysticstars.net/gifs/star_bul.gif -e "*"
HTTP/1.1 403 Forbidden
Date: Wed, 25 Jun 2014 15:45:40 GMT
Server: Apache/2.2.27
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1007
Content-Type: text/html

curl -I http://mysticstars.net/gifs/star_bul.gif -e "http://mysticstars.net"
HTTP/1.1 200 OK
Date: Wed, 25 Jun 2014 15:46:37 GMT
Server: Apache/2.2.27
Last-Modified: Wed, 26 Sep 2007 20:56:22 GMT
ETag: "1a08a9c-e3-43b1016084980"
Accept-Ranges: bytes
Content-Length: 227
Content-Type: image/gif

As @Wayne Whitty points out, this is likely due to rewrite rules preventing hotlinking.

To my knowledge, javascript cannot pass the referrer field, so you may have to amend the hotlink rules.

Improve this answer
3
  • +1, this appears to be the correct explanation in this case. Further testing shows that the server accepts an empty referrer (-e ""), as a browser would send if you typed the image URL into the address bar, but not a referral from another site. (Also, despite what I suggested in earlier comments, the Accept header does not seem to make any difference for this site.)
    – Ilmari Karonen
    Jun 25, 2014 at 16:05
  • I usually see Accept header issues when caching is used and the Vary does not distinguish between compressed/uncompressed or mobile/desktop content.
    – jeffatrackaid
    Jun 25, 2014 at 16:18
  • You are obviously right. I didn't think JS was sending a referrer by default.
    – chris
    Jun 26, 2014 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.