Search code examples
jquerypostxsshttp-status-code-403httpforbiddenhandler

POST returns 403 if URL is in data


I am doing a simple jQuery post:

$.post( "script.php", { urls: listOfURLs} );

The post works fine if it contains no URLs, however, if there are URLs included, then I get:

POST script.php 403 (Forbidden)

Is there some way I can sanitize this list of URLs or something to prevent it from 403ing?

Everything involved is on the same domain.


Solution

  • As far as I can see : this "bug" is on the server side.

    The object passed as a second argument to the $.post() methods is simply serialized as data in your request.

    You can see what is sent to the server by checking your browser's web console (e.g : the "Net" tab of Firebug, or the "Network" tab of Firefox' built-in console, or similar tabs in Chrome or IE). My guess is your request is correctly sent with the data you provided.

    What your server does with this data is another matter ; you will need to debug your server configuration and server side code to figure out how your request ultimately triggers a 403.

    One possible cause for a 403 is bad file permissions. Check if your files permission allow the web server to access them.

    For example, if you are using a standard apache/linux configuration, check if :

    • user www-data has x rights on all code directories
    • user www-data has r rights on all code files
    • user www-data has correct rights on files which should be downloaded or uploaded
    • your site config file removes access from certain directories
    • your .htaccess file(s) remove access from certain directories
    • etc ...