ErrorDocument 403 Does Not Work

[phdphd]

Hi All,

In an .htaccess file, I am trying to implement a 404 and a 403 ErrorDocument directives, like this :

ErrorDocument 403 /path/403.html
ErrorDocument 404 /path/404.html

While the 404 directive works correctly by displaying the content of the 404.html file, the 403 one still leads to the display of the generic "403 Forbidden You don't have permission to access....".

Did I miss something?

Thanks!

 

[Steven74]

Have you tried:

ErrorDocument 403 https://www.yourwebsite.com/path/403.html

 

Edited September 24, 2018 by Steven74

[requinix]

Have you granted access to the 403.html page?

[phdphd]

1 hour ago, requinix said:

Have you granted access to the 403.html page?

I made nothing special to neither grant nor deny access. Since 404.html page is accessible (its contents shows), and it is in the same folder as 403.html, I guess that 403.html should be accessible too. Am I wrong?

[requinix]

What is causing the 403 to happen in the first place?

[phdphd]

Adding "/" (trailing slash) causes 403 to happen.

Adding "/blablabla" causes a page reload with loss of css styling.

[requinix]

The 403 in the first one is because you're requesting a directory, it doesn't have a DirectoryIndex file, and you told Apache not to list directory contents. Thus a 403. So either add a DirectoryIndex, allow Apache to list directory contents, or live with the 403 and don't link people to it.

The lack of CSS in the second one is because you're using relative URLs for your CSS files when you should be absolute URLs. Absolute ones start with a slash and will work from anywhere on your site, relative ones don't and won't.

But back to the original question. What happens if you go to /path/403.html yourself in the browser?

[phdphd]

Entering myself /path/403.html  loads the 403.html file and displays its contents.

I was wrong in saying that the CSS gets lost. It is not the CSS (in fact it is inline CSS) but the JS code, which does some formatting and is stored in a separate JS file. Sorry about that, but I guess what you said is also valid for JS too.

 

[requinix]

So to make sure: you're going to some directory with a trailing slash and getting the plain 403 instead of the custom 403 page? Does the page have two sentences on it or three?

[phdphd]

Well, now, using absolute URLs for the external js file, both custom pages display correctly.

There is another point  : Does the fact of using absolute URLs for css & js requires also the use of absolute URLs for the "action" attribute in HTML forms ? The page contains a form and it seemed to me that leaving a relative URL in the "action" attribute would lead to the reload of the page instead of loading the page pointed by the action attribute.

[requinix]

It depends where the page is and where the thing you want to reference is.

An absolute URL (meaning it starts with a slash, not that it has the full scheme and hostname in it) will work everywhere. A relative URL (no leading slash) means it is relative to the current "directory" of the page.

Right now I'm looking at /topic/307719-errordocument-403-does-not-work/?tab=comments#comment-1561188. The "directory" would be /topic/307719-errordocument-403-does-not-work/ (note there was a trailing slash) so a relative URL of "foo" will go to /topic/307719-errordocument-403-does-not-work/foo. If that's what I want then okay. But if I want /foo then I have to actually write "/foo". The other option is "../../foo" but that's stupid so don't do it.

Want the page to submit back to itself? Then a relative URL is fine. Or leave the action blank. But an absolute URL wouldn't be harmful.