For a web page that exists, but for which a user does not have sufficient privileges (they are not logged in or do not belong to the proper user group), what is the proper HTTP response to serve?

`401 Unauthorized`?  
`403 Forbidden`?  
Something else?

What I&#39;ve read on each so far isn&#39;t very clear on the difference between the two. What use cases are appropriate for each response?

403 Forbidden vs 401 Unauthorized HTTP responses

Error message &quot;Forbidden You don&#39;t have permission to access / on this server&quot;

I have 3 domain names and am trying to host all 3 sites on one server (a Digital Ocean droplet) using Nginx.

mysite1.name
mysite2.name
mysite3.name

Only 1 of them works.  The other two result in 403 errors (in the same way).

In my nginx error log, I see: `[error] 13108#0: *1 directory index of &quot;/usr/share/nginx/mysite2.name/live/&quot; is forbidden`.

My sites-enabled config is:

    server {
            server_name www.mysite2.name;
            return 301 $scheme://mysite2.name$request_uri;
    }
    server {
            server_name     mysite2.name;
    
            root /usr/share/nginx/mysite2.name/live/;
            index index.html index.htm index.php;
    
            location / {
                    try_files $uri $uri/ /index.html index.php;
            }
    
            location ~ \.php$ {
                    fastcgi_split_path_info ^(.+\.php)(/.+)$;
                    fastcgi_pass unix:/var/run/php5-fpm.sock;
                    fastcgi_index index.php;
                    include fastcgi_params;
            }
    }

All 3 sites have nearly identical config files.

Each site&#39;s files are in folders like /usr/share/nginx/mysite1.name/someFolder, and then /usr/share/nginx/mysite1.name/live is a symlink to that. (Same for mysite2 and mysite3.)

I&#39;ve looked at https://stackoverflow.com/questions/6795350/nginx-403-forbidden-for-all-files?rq=1 but that didn&#39;t help. 

Any ideas on what might be wrong?

Nginx 403 error: directory index of [folder] is forbidden

I have nginx installed with PHP-FPM on a CentOS 5 box, but am struggling to get it to serve any of my files - whether PHP or not.

Nginx is running as www-data:www-data, and the default &quot;Welcome to nginx on EPEL&quot; site (owned by root:root with 644 permissions) loads fine.

The nginx configuration file has an include directive for &lt;i&gt;/etc/nginx/sites-enabled/*.conf,&lt;/i&gt; and I have a configuration file *example.com.conf*, thus:

    server {
     listen 80;

     Virtual Host Name
     server_name www.example.com example.com;


     location / {
       root /home/demo/sites/example.com/public_html;
       index index.php index.htm index.html;
     }

     location ~ \.php$ {
      fastcgi_pass   127.0.0.1:9000;
      fastcgi_index  index.php;
      fastcgi_param  PATH_INFO $fastcgi_script_name;
      fastcgi_param  SCRIPT_FILENAME  /home/demo/sites/example.com/public_html$fastcgi_script_name;
      include        fastcgi_params;
     }
    }
Despite public_html being owned by www-data:www-data with 2777 file permissions, this site fails to serve any content -

     [error] 4167#0: *4 open() &quot;/home/demo/sites/example.com/public_html/index.html&quot; failed (13: Permission denied), client: XX.XXX.XXX.XX, server: www.example.com, request: &quot;GET /index.html HTTP/1.1&quot;, host: &quot;www.example.com&quot;

I&#39;ve found numerous other posts with users getting 403s from nginx, but most that I have seen involve either more complex setups with Ruby/Passenger (which in the past I&#39;ve actually succeeded with) or are only receiving errors when the upstream PHP-FPM is involved, so they seem to be of little help.

Have I done something silly here?

Nginx 403 forbidden for all files

I was trying to __scrape__ a website for practice, but I kept on getting the HTTP Error 403 (does it think I&#39;m a bot)?

Here is my code:

    #import requests
    import urllib.request
    from bs4 import BeautifulSoup
    #from urllib import urlopen
    import re
    
    webpage = urllib.request.urlopen(&#39;http://www.cmegroup.com/trading/products/#sortField=oi&amp;sortAsc=false&amp;venues=3&amp;page=1&amp;cleared=1&amp;group=1&#39;).read
    findrows = re.compile(&#39;&lt;tr class=&quot;- banding(?:On|Off)&gt;(.*?)&lt;/tr&gt;&#39;)
    findlink = re.compile(&#39;&lt;a href =&quot;&gt;(.*)&lt;/a&gt;&#39;)
    
    row_array = re.findall(findrows, webpage)
    links = re.finall(findlink, webpate)
    
    print(len(row_array))
    
    iterator = []

The error I get is:

     File &quot;C:\Python33\lib\urllib\request.py&quot;, line 160, in urlopen
        return opener.open(url, data, timeout)
      File &quot;C:\Python33\lib\urllib\request.py&quot;, line 479, in open
        response = meth(req, response)
      File &quot;C:\Python33\lib\urllib\request.py&quot;, line 591, in http_response
        &#39;http&#39;, request, response, code, msg, hdrs)
      File &quot;C:\Python33\lib\urllib\request.py&quot;, line 517, in error
        return self._call_chain(*args)
      File &quot;C:\Python33\lib\urllib\request.py&quot;, line 451, in _call_chain
        result = func(*args)
      File &quot;C:\Python33\lib\urllib\request.py&quot;, line 599, in http_error_default
        raise HTTPError(req.full_url, code, msg, hdrs, fp)
    urllib.error.HTTPError: HTTP Error 403: Forbidden


Problem HTTP error 403 in Python 3 Web Scraping

I recently tried to set a test server up with Apache. The site must run under domain `www.mytest.com`. I always get a `403 Forbidden` error. I am on Ubuntu 10.10 server edition. The doc root is under dir `/var/www`. The following are my settings:

**Content of /var/www**

    ls -l /var/www/

    total 12
    drwxr-xr-x 2 root root 4096 2011-08-04 11:26 mytest.com
    -rwxr-xr-x 1 root root 177 2011-07-25 16:10 index.html


**Content of the host file on the server (with IP 192.168.2.5)**

    cat /etc/hosts

    127.0.0.1 localhost 
    127.0.1.1 americano
    192.168.2.5 americano.mytest.com www.mytest.com

    # The following lines are desirable for IPv6 capable hosts
    ::1 localhost ip6-localhost ip6-loopback
    fe00::0 ip6-localnet
    ff00::0 ip6-mcastprefix
    ff02::1 ip6-allnodes
    ff02::2 ip6-allrouters

**Site config**

    &lt;VirtualHost *&gt;
    ServerAdmin admin@mytest.com
    ServerName www.mytest.com
    ServerAlias mytest.com
    
    DocumentRoot &quot;/var/www/mytest.com&quot;
    
    ErrorLog /var/log/apache2/mytest-error_log
    CustomLog /var/log/apache2/mytest-access_log combined
    
    #
    # This should be changed to whatever you set DocumentRoot to.
    #
    &lt;Directory &quot;/var/www/mytest.com&quot;&gt;
    Options -Indexes FollowSymLinks
    AllowOverride None
    
    Order allow,deny
    Allow from all
    &lt;/Directory&gt;
    &lt;/VirtualHost&gt;

I have no `.htaccess` file in my doc root. The permissions are set correctly (readable by www-data).

If I type in the IP address from my desktop, the site shows up correctly. I changed the hosts file on my desktop to point `www.mytest.com` to the server&#39;s IP. When I use it, I get `403`. Since many functions of this site are sitename-sensitive, I have to be able to access the site by the domain name.

Another funky thing is, even if all log files are created properly, they have no information regarding this error.

I am stuck. Can anybody help?

Apache VirtualHost 403 Forbidden

I have installed WAMP version 2.1 on my windows 7 machine. When i browse to localhost in my browser, the WAMP server page is visible.

But when I browse to my IP in my browser, I get the message 

&gt;403 Forbidden: You don&#39;t have permission to access / on this server.

Any suggestions?

WAMP 403 Forbidden message on Windows 7

I have build a .net4.5 ASP.NET MVC4 web app which works fine locally (IIS Express &amp; dev server) but once i deploy it to my web server it throws the 403 error. I have installed .Net 4.5RC on the server and even tried the 
`aspnet_regiis -i`
bit that everyone recommended for their issues with previous versions of MVC/.Net but it did not help.

Any ideas?

**EDIT**:
More info about the situation. The server is 32bit and I have 4 other MVC3 applications that work fine. It is just my MVC4 app that is not working.

MVC4 HTTP Error 403.14 - Forbidden

I know you can send a header that tells the browser this page is forbidden like:

    header(&#39;HTTP/1.0 403 Forbidden&#39;);

But how can I also display the custom error page that has been created on the server for this type of error?

By default, just sending the header displays a white page, but I remember a while back reading that you can use the customer error page. Does anybody know?



Emulate a 403 error page

I have Nginx setup and displaying the test page properly. If I try to change the root path, I get a 403 Forbidden error, even though all permissions are identical. Additionally, the nginx user exists.

nginx.conf:

    user nginx;
    worker_processes  1;
    
    error_log  /var/log/nginx/error.log;
    
    pid        /run/nginx.pid;
    
    events {
        worker_connections  1024;
    }
    
    http {
        index   index.html index.htm;
    
        server {
            listen       80;
            server_name  localhost;
            root         /var/www/html; #changed from the default /usr/share/nginx/html
        }
    }

namei -om /usr/share/nginx/html/index.html

    f: /usr/share/nginx/html/index.html
    dr-xr-xr-x root root /
    drwxr-xr-x root root usr
    drwxr-xr-x root root share
    drwxr-xr-x root root nginx
    drwxr-xr-x root root html
    -rw-r--r-- root root index.html

namei -om /var/www/html/index.html

    f: /var/www/html/index.html
    dr-xr-xr-x root root /
    drwxr-xr-x root root var
    drwxr-xr-x root root www
    drwxr-xr-x root root html
    -rw-r--r-- root root index.html

error log

&gt; 2014/03/23 12:45:08 [error] 5490#0: *13 open()
&gt; &quot;/var/www/html/index.html&quot; failed (13: Permission denied), client:
&gt; XXX.XX.XXX.XXX, server: localhost, request: &quot;GET /index.html HTTP/1.1&quot;, host: &quot;ec2-XXX-XX-XXX-XXX.compute-1.amazonaws.com&quot;

Why does Nginx return a 403 even though all permissions are set properly?

I am writing a small Java program to get the amount of results for a given Google search term. For some reason, in Java I am getting a 403 Forbidden but I am getting the right results in web browsers. Code:

    import java.io.BufferedReader;
    import java.io.IOException;
    import java.io.InputStreamReader;
    import java.net.URL;
    
    
    public class DataGetter {
    
    	public static void main(String[] args) throws IOException {
    		getResultAmount(&quot;test&quot;);
    	}
    	
    	private static int getResultAmount(String query) throws IOException {
    		BufferedReader r = new BufferedReader(new InputStreamReader(new URL(&quot;https://www.google.com/search?q=&quot; + query).openConnection()
    				.getInputStream()));
            String line;
            String src = &quot;&quot;;
            while ((line = r.readLine()) != null) {
            	src += line;
            }
            System.out.println(src);
            return 1;
    	}
    
    }

And the error:

    Exception in thread &quot;main&quot; java.io.IOException: Server returned HTTP response code: 403 for URL: https://www.google.com/search?q=test
    	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
    	at DataGetter.getResultAmount(DataGetter.java:15)
    	at DataGetter.main(DataGetter.java:10)

Why is it doing this?

403 Forbidden with Java but not web browser?

I am getting an 403 access forbidden when attempting to open a page under a vhost where the document root is sitting on a different drive than where apache is sitting. I installed using the apachefriends release. This is my httpd-vhosts.conf file: 

&lt;pre&gt;&lt;code&gt;
NameVirtualHost 127.0.0.1

&amp;lt;VirtualHost 127.0.0.1&gt;
  ServerName foo.localhost
  DocumentRoot &quot;C:/xampp/htdocs/foo/public&quot;
&amp;lt;/VirtualHost&gt;

&amp;lt;VirtualHost 127.0.0.1&gt;
  ServerName bar.localhost
  DocumentRoot &quot;F:/bar/public&quot;
&amp;lt;/VirtualHost&gt;
&lt;/pre&gt;&lt;/code&gt;

When opening bar.localhost in my browser, Apache is giving me 403 Access Forbidden. I tried setting lots of different access rights, even full rights to everyone, but nothing I tried helped.

Edit: Thanks! For future reference, add &#39;Options indexes&#39; within to show directory indexes.

Apache gives me 403 Access Forbidden when DocumentRoot points to two different drives

I installed the elmah.mvc nuget package and kept the default configuration of that sans setting up sending an email and plugging it into a SQL database.

On my local machine when I use the Visual Studio host, I can open my app and access /elmah fine to see a report of the errors. However, when I try and access /elmah on production, I get two errors, first I get a `403 access is denied` server error. Then in my email (from elmah) I get:

    System.Web.HttpException: Server cannot set status after HTTP headers have been sent.

Anyone know what is going on here and how to fix? Thanks.

I tried the following so far as suggested by the answers below:

In `&lt;system.webServer&gt;`

    &lt;handlers&gt;
      &lt;add name=&quot;elmah&quot; verb=&quot;GET&quot; path=&quot;elmah.axd&quot; type=&quot;Elmah.ErrorLogPageFactory, Elmah&quot;/&gt;
    &lt;/handlers&gt;

And in `&lt;system.web&gt;`

    &lt;httpHandlers&gt;
    &lt;add verb=&quot;POST,GET,HEAD&quot; path=&quot;elmah.axd&quot; type=&quot;Elmah.ErrorLogPageFactory, Elmah&quot; /&gt;
    &lt;/httpHandlers&gt;

I tried setting the path to both `elmah.axd` and simply `~/elmah`. All still give the same error, and still works locally, but not in production.

**Edit:** It actually also works when I remote into the server and access it via browser on there (not using localhost, but the actual site address). So what permission am I not having? Seems like it&#39;s at the server level.

Can&#39;t access /elmah on production server with Elmah MVC?

I&#39;m hitting an API that will occasionally throw a HTTP 403 error, and the response body can give some extra information in the form of json, however for the life of me I can&#39;t seem to get the information back out from the Alamofire response objects.  I see the information in developer tools if I hit the API via chrome.  Here&#39;s my code:

    Alamofire.request(mutableURLRequest).validate().responseJSON() {
        (response) in
        switch response.result {
            case .Success(let data):
                if let jsonResult = data as? NSDictionary {
                    completion(jsonResult, error: nil)
                } else if let jsonArray = data as? NSArray {
                    let jsonResult = [&quot;array&quot; : jsonArray]
                    completion(jsonResult, error: nil)
                }
            case .Failure(let error):
                //error tells me 403
                //response.result.data can&#39;t be cast to NSDictionary or NSArray like
                //the successful cases, how do I get the response body?
        }

I&#39;ve queried pretty much every object attached to the response, but it doesn&#39;t seem to give me the response body back in the case of HTTP errors.  Is there a work-around or something I&#39;m missing here?

Any way to get the response body during HTTP errors?

Is there a way to get around the following?

    httperror_seek_wrapper: HTTP Error 403: request disallowed by robots.txt

Is the only way around this to contact the site-owner (barnesandnoble.com).. i&#39;m building a site that would bring them more sales, not sure why they would deny access at a certain depth.

I&#39;m using mechanize and BeautifulSoup on Python2.6.

hoping for a work-around

Screen scraping: getting around &quot;HTTP Error 403: request disallowed by robots.txt&quot;

I read https://stackoverflow.com/questions/3050518/what-http-status-response-code-should-i-use-if-the-request-is-missing-a-required but it did not specifically ask about headers and there didn&#39;t seem to be a consensus.

The context of this question assumes successful authentication.  I&#39;m currently favoring either a 400 (though that doesn&#39;t feel right because this isn&#39;t really a case of &quot;malformed syntax&quot;) or 403.  Given 403&#39;s description:

&gt; The server understood the request, but is refusing to fulfill it.
&gt; Authorization will not help and the request SHOULD NOT be repeated. **If
&gt; the request method was not HEAD and the server wishes to make public
&gt; why the request has not been fulfilled, it SHOULD describe the reason
&gt; for the refusal in the entity.**

This makes the most sense to me.

Can someone please enlighten me?  Thanks.

What is the most appropriate HTTP status code to return if a required header is missing?

I&#39;m running ubuntu 13.04 64bit on my desktop, I installed Apache2, MySQL and PHP etc.

I wanted to have my web root in `/home/afflicto/public_html` instead of `/var/www`.
So I went along with this guide:  
http://www.maketecheasier.com/install-and-configure-apache-in-ubuntu/2011/03/09  
(I did everything from &quot;configuring different sites&quot;) as I like the solution more.

**Here&#39;s what I did:**  
Installed Apache2, MySQL etc..  
copied `/etc/apache2/sites-avaliable/default` to `/etc/apache2/sites-available/afflicto`. Then edited it, it now looks like the following:

**/etc/apache2/sites-available/afflicto**  

    &lt;VirtualHost *:80&gt;
	ServerAdmin webmaster@localhost

	DocumentRoot /home/afflicto/public_html
	&lt;Directory /&gt;
		Options FollowSymLinks
		AllowOverride None
	&lt;/Directory&gt;
	&lt;Directory /home/afflicto/public_html/&gt;
		Options Indexes FollowSymLinks MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
	&lt;/Directory&gt;

	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
	&lt;Directory &quot;/usr/lib/cgi-bin&quot;&gt;
		AllowOverride None
		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
		Order allow,deny
		Allow from all
	&lt;/Directory&gt;

	ErrorLog ${APACHE_LOG_DIR}/error.log

	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.
	LogLevel warn

	CustomLog ${APACHE_LOG_DIR}/access.log combined
    &lt;/VirtualHost&gt;  

I did `sudo a2dissite default &amp;&amp; sudo a2ensite afflicto &amp;&amp; sudo service apache2 restart`  

I created a `index.php` and `index.html` in `/home/afflicto/public_html/test/`  
when accessing `localhost/test` or `localhost/test/index.html` etc, I get 403 forbidden error.  

What am I doing wrong? thanks in advance.

**update 1**  
I have set the owner of the public_html directory to `www-data`.  
Also `sudo chmod -R +x public_html &amp;&amp; sudo chmod -R 777 public_html`  
Still same 403 error.

Here&#39;s the output of the apache error log:  

    [Sun Jul 14 06:10:32 2013] [error] [client 127.0.0.1] (13)Permission denied: access to / denied

    [Sun Jul 14 06:10:32 2013] [error] [client 127.0.0.1] (13)Permission denied: access to /favicon.ico denied

All Http Status-Code-403 Solutions on Gang of Coders

Total of 17 Http Status-Code-403 Solutions