Modern Vespa : HTTP/1.1 403 Forbidden

HTTP/1.1 403 Forbidden

OP Matchlessman UTC details Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 758 Location: UK
OP Matchlessman Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 758 Location: UK	UTC quote I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone?

Max6200 UTC details Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA
Max6200 Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA	UTC quote Matchlessman wrote: I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone? You're being punished by the Vespa gods

OP Matchlessman UTC details Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 758 Location: UK
OP Matchlessman Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 758 Location: UK	UTC quote Max6200 wrote: You're being punished by the Vespa gods It'll be yellow boots next.

Max6200 UTC details Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA
Max6200 Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA	UTC quote Matchlessman wrote: It'll be yellow boots next. Don't you forgot it. It's a major award which makes me a major member in my head.

Halijaro UTC details Molto Verboso '99 PX200 & GTS300 HPE SuperSport Joined: UTC Posts: 1494 Location: Cheshire, England, UK.
Halijaro Molto Verboso '99 PX200 & GTS300 HPE SuperSport Joined: UTC Posts: 1494 Location: Cheshire, England, UK.	UTC quote Matchlessman wrote: I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone? Same for me on Chrome desktop. Fine using Chrome on phone though (Android).

fledermaus UTC details Veni, Vidi, Posti 2015 GTS 2017 BV 350 Joined: UTC Posts: 12939 Location: Fond du Lac, Wisconsin
fledermaus Veni, Vidi, Posti 2015 GTS 2017 BV 350 Joined: UTC Posts: 12939 Location: Fond du Lac, Wisconsin	UTC quote Yeah, kinda weird. I'm fine on my phone...

Shebalba UTC details Ossessionato 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 2149 Location: Oceanside, CA
Shebalba Ossessionato 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 2149 Location: Oceanside, CA	UTC quote I have also been 'dubbed thee unforbidden.' It's only Chrome.. I sacrificed my soul and tried Edge and everything is fine.. safari on my phone is also fine. Or I wouldn't be posting this.

JimVanMorrissey UTC details Addicted Vespa PX200 Joined: UTC Posts: 605 Location: Belgrade
JimVanMorrissey Addicted Vespa PX200 Joined: UTC Posts: 605 Location: Belgrade	UTC quote Same issue with Chrome here. Thought it might be my IP (I'm in Serbia, kinda dodgy) but no, seems to be a global problem.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

There are a variety of things that can trigger a 403 Forbidden error. Is there any other informative text below the 403?

How long has it been happening? What were you doing when it first happened?

One potential reason for a 403 error is if a lot of requests are made in a very short amount of time -- the server is protecting itself against bots. Obviously, you all are not bots, but it is possible that Chrome is doing something that makes the server think it's a bot.

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote I'm using Chrome right now (on macOS) and not seeing any obvious problems. I'd really like to hear more about what specific activities are involved.

SteelBytes

UTC

details

Veni, Vidi, Posti

2019 GTS 300 HPE w Malossi

Joined: UTC
Posts: 9072
Location: Batmania aka Melbourne, Aus

SteelBytes

Veni, Vidi, Posti

2019 GTS 300 HPE w Malossi

Joined: UTC
Posts: 9072
Location: Batmania aka Melbourne, Aus

UTC quote

jess wrote:

I'm using Chrome right now (on macOS) and not seeing any obvious problems. I'd really like to hear more about what specific activities are involved.

broken on Brave on Windows (both computers that I tried), works on Brave on Android. This is posted using Edge on the same computer.

I did nothing. Just got out of bed, picked up my laptop, walked to the cafe and tried to surf MV while drinking my liquid breakfast. No go.

here's the details from brave

request
------
Request URL: https://modernvespa.com/forum/new
Request Method: GET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-AU,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: mv_token=XXXXXXXXXXXX (removed)
Host: modernvespa.com
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Brave";v="110"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Sec-GPC: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110

response
-----
Status Code: 403 Forbidden
Remote Address: 50.18.170.78:443
Referrer Policy: strict-origin-when-cross-origin
Connection: Keep-Alive
Content-Length: 132
Content-Type: text/html; charset=UTF-8
Date: Thu, 09 Mar 2023 08:04:31 GMT
Keep-Alive: timeout=5, max=99
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache/2.4.54 () OpenSSL/1.0.2k-fips PHP/7.4.33
X-Frame-Options: SAMEORIGIN
X-Powered-By: PHP/7.4.33

<html>
<head>
<title>403 Forbidden</title>
</head>
<body>
<h1>HTTP/1.1 403 Forbidden</h1>
<p></p>
</body>
</html>

Positive

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote SteelBytes wrote: here's the details from brave Thanks for that. It doesn't tell me a lot, but it does tell me that the error is being returned from the application layer (the forum software) rather than some lower-level server component. The funny thing is that nothing on the server has actually changed for weeks.

SteelBytes

UTC

details

Veni, Vidi, Posti

2019 GTS 300 HPE w Malossi

Joined: UTC
Posts: 9072
Location: Batmania aka Melbourne, Aus

SteelBytes

Veni, Vidi, Posti

2019 GTS 300 HPE w Malossi

Joined: UTC
Posts: 9072
Location: Batmania aka Melbourne, Aus

UTC quote

jess wrote:

Thanks for that. It doesn't tell me a lot, but it does tell me that the error is being returned from the application layer (the forum software) rather than some lower-level server component.

The funny thing is that nothing on the server has actually changed for weeks.

did a bit more digging ...

ya know when you press F12 and get the debugging tab (forget the name) there is a button that lets you make it emulate different devices - eg pretend to be an iphone 12 or a pixel 5 etc. if I turn on that button and refresh it then works (turn off and refresh and it breaks again). So I looked at the headers during that and it doesn't include the "sec-ch-xxx" set of headers (the other Sec-Fetch and Sec-GPS are still there)

Positive

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote Try regular chrome (with the default user agent) again and tell me if it works. (I removed a ban on a specific agent that was triggered by an overlimit client)

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Try regular chrome (with the default user agent) again and tell me if it works. (I removed a ban on a specific agent that was triggered by an overlimit client) don't have regular chrome handy (bit lazy to install it just for this test). Anyone else wanna check with regular Chrome?

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote SteelBytes wrote: don't have regular chrome handy (bit lazy to install it just for this test). Anyone else wanna check with regular Chrome? Or Brave.

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Or Brave. it works!

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote SteelBytes wrote: it works! Does Brave use the standard Chrome user agent?

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE w Malossi Joined: UTC Posts: 9072 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Does Brave use the standard Chrome user agent? it says Chrome in it so ... guess so? SteelBytes wrote: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

SteelBytes wrote:

it says Chrome in it so ... guess so?

It's not the word Chrome that triggers it, it's the exact user agent string. It looks like the output you pasted in doesn't include the tail end of the user agent string, but the rest of it matches the problem user agent that was put in the penalty box for being overlimit (i.e. too many requests in a short amount of time).

There is a subset of malicious bots that uses constantly-changing IP addresses to barrage the server with requests, but uses the same user agent for all the requests. The code in question was trying to catch that behavior, but snagged all Windows Chrome users (presumably using the latest version) in the process.

I will have to rethink that aspect of session management. I've commented it out for now, so hopefully it won't snag any other innocent bystanders.

Thanks much for the assist.

JOHNTEE UTC details Hooked Vespa ET4 Joined: UTC Posts: 155 Location: Sheffield England
JOHNTEE Hooked Vespa ET4 Joined: UTC Posts: 155 Location: Sheffield England	UTC quote All back to normal now Positive

chandlerman

UTC

details

Innovator

63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3, 63 Lammy S3 Riverside

Joined: UTC
Posts: 12967
Location: Nashville

283 Days Since Last Explosion

chandlerman

Innovator

63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3, 63 Lammy S3 Riverside

Joined: UTC
Posts: 12967
Location: Nashville

283 Days Since Last Explosion

UTC quote

jess wrote:

Are you using WAF or CloudFront to get the Shield Basic protections? Either of those would protect you, albeit at a (potentially-minimal) cost. The default edge security just provides basic packet hygiene, so protection for IP Stack level stuff like syn floods.

Shebalba UTC details Ossessionato 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 2149 Location: Oceanside, CA
Shebalba Ossessionato 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 2149 Location: Oceanside, CA	UTC quote Also back up and running. I know zero about code, so thank you to SteelBytes for saying all of those computer words to Jess. And thank you to Jess who, I think, took all of the computer words from SteelBytes and resolved it. Positive

adri UTC details Atypical Canadian 2009 Vespa S50(LX150 motor swap), 2006 Vespa GTS250ie Joined: UTC Posts: 2319 Location: Toronto, Canada
adri Atypical Canadian 2009 Vespa S50(LX150 motor swap), 2006 Vespa GTS250ie Joined: UTC Posts: 2319 Location: Toronto, Canada	UTC quote About 24 hours on access for me either. Pretty sure Jess just banned us for some fun lol

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

chandlerman wrote:

We use CloudFront as a CDN for all the attachments and the other various non-dynamic assets (icons, fonts, images, etc). This keeps the load off the main server and means we can run a fairly lightweight main server instance. Plus, of course, all the images load faster around the world.

We don't use CloudFront on the main server (modernvespa.com) at all. Nor WAF. The defense mechanisms we use predate both CloudFront and WAF (by a lot) and have largely grown organically with the site. I'm not sure converting to WAF at this point would be straightforward -- it would be hard to capture all the different rules that I've put into place over the last (checks watch) 17 years.

I'll give it a closer look and see if it seems plausible, at least.

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote adri wrote: About 24 hours on access for me either. Pretty sure Jess just banned us for some fun lol Yeah, not my idea of a good time.

chandlerman

UTC

details

Innovator

63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3, 63 Lammy S3 Riverside

Joined: UTC
Posts: 12967
Location: Nashville

283 Days Since Last Explosion

chandlerman

Innovator

63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3, 63 Lammy S3 Riverside

Joined: UTC
Posts: 12967
Location: Nashville

283 Days Since Last Explosion

UTC quote

jess wrote:

We don't use CloudFront on the main server (modernvespa.com) at all. Nor WAF. The defense mechanisms we use predate both CloudFront and WAF (by a lot) and have largely grown organically with the site. I'm not sure converting to WAF at this point would be straightforward -- it would be hard to capture all the different rules that I've put into place over the last (checks watch) 17 years.

I'll give it a closer look and see if it seems plausible, at least.

That makes sense. Assuming the main server is sitting behind an ALB or ELB, it would be pretty simple to turn WAF on. Unless the legacy protections are very site-specific, you'd probably find that those events Just Went Away with WAF turned on.

And not that I'm totally shilling for AWS (but, full transparency, I *do* work there) the cost of WAF would probably be near zero unless MV does a lot more traffic than I think.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

chandlerman wrote:

That makes sense. Assuming the main server is sitting behind an ALB or ELB, it would be pretty simple to turn WAF on.

The main server is just a standard EC2 instance without any load balancing. And not a very big instance at that -- currently t4g.small.

chandlerman wrote:

Unless the legacy protections are very site-specific, you'd probably find that those events Just Went Away with WAF turned on.

Some of the protections are very site specific. We're running a very, very old (and very modified) version of phpBB2. Scripted forum attacks for phpBB2 and phpBB3 have been commonly used by spammers and other malicious actors, and I've found that altering the basic environment in ways that are unique to MV has kept us largely free of automated spam. The spam that does get through is manually posted by low-paid grunts, mostly in India these days.

chandlerman wrote:

And not that I'm totally shilling for AWS (but, full transparency, I *do* work there) the cost of WAF would probably be near zero unless MV does a lot more traffic than I think.

I'm actually a bit of an AWS fanboy, and have incorporated quite a few AWS services into the MV code in ways that would make it difficult to run MV on any other host. I'm comfortable with that.

I don't think the cost would be zero -- a brief look at the pricing chart for US West (Northern California) puts the cost at $5 per month and $1 per rule. I suspect the number of rules I would need would be the kicker, as phpBB's very old design distributes entry points across about a hundred different PHP files, each with subtly different requirements. It's a mess, actually. I'm still reading the docs to get a better sense of what WAF can do.

⬆️ About 2 years elapsed ⬇️

JKJ-FZ6

UTC

details

Ossessionato

BV400, Primavera 150, Yamaha Zuma 125

Joined: UTC
Posts: 4815
Location: Twin Cities, Minnesota

JKJ-FZ6

Ossessionato

BV400, Primavera 150, Yamaha Zuma 125

Joined: UTC
Posts: 4815
Location: Twin Cities, Minnesota

UTC quote

I've been getting a 403 Forbidden error for the last two weeks or so. It's not constant; sometimes it lasts overnight, sometimes it clears up in a few minutes.

I don't understand all of the discussion above but it seems to be related to my IP address or router. It's happening when I log on from my Windows 11 desktop computer with Firefox, also with my iPhone with Safari. I also get the error when I use Linux and Firefox on the same desktop computer.

Just now, I've turned off wireless on my phone so I'm using mobile data without going through the router and I'm able to log in to MV.

I'm willing to try anything that could help diagnose the problem. Thanks.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

JKJ-FZ6 wrote:

First, it's almost certainly not your fault. My apologies for that.

I've been making near-constant changes to the way sessions are handled on the site, trying to stay one step ahead of the bots and the scrapers and all the other miscreants that hit the site every day. Occasionally (or even often!) I seem to get it wrong and the system ends up banning the IP address of a legitimate user, which is probably what's happened here.

The first step is to try to get you unbanned. To do so, we will need to figure out what the public IP address on the device(s) where you are having the problem.

Go to: https://whatismyipaddress.com

I'll need the IPv4 address that shows up near the top of that page. You can PM me or, if you get stuck on all your devices, you can email support@modernvespa.com.

Once I get that, I can unban you and then search the logs to try to figure out what happened. In an ideal world, I will learn something from this.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

JKJ-FZ6 - I've pushed some changes to the server to try to remedy the problem. I've also un-banned all currently-banned IP addresses, so you should be good to go now.

Ultimately, this is still a band-aid, as I don't yet understand the root cause. Well, I understand half of it, but not the other half.

This problem appears to be related to another attempted improvement I've made recently. In order to reduce the intrusion on registered members (when they happen to be not logged in) I am whitelisting IP addresses for a short period -- basically saying "this was recently a logged-in user, so let's not hassle them unnecessarily".

As they say, the road to hell is paved with good intentions.

In your specific case, it looks like the system correctly recognized that your IP was whitelisted (yay!) and decided to do the minimal possible screening, which is just to attach a small script to the end of the first few pages you requested that sends back a signal to the server saying "I'm human".

Unfortunately, that signal never arrived, for whatever reason. And after 10 requests, the system decided it had had enough and banned your IP. And the whitelisting might have exacerbated the issue.

So my new approach is to slowly ramp up the invasiveness of screening -- giving whitelisted clients a pass for the first few requests, and then if we still aren't sure they are human, ramp up the screening methods. Further, if a whitelisted IP address gets to the maximum number of requests and still isn't marked as human, then we'll log an error message on the server (so I know it's happening) and then give them a pass anyway.

My hunch (and this is only a hunch) is that something in your particular Firefox setup is preventing the low-impact script from sending a signal back to the server -- perhaps it is seen as a tracker or something by FireFox (or whatever plugins you might have running on it). In a way, it is a tracker, but it's really only to determine if you're human, not to uniquely identify you and serve you advertising. I mean, we don't even have any advertising

But again, that's only a guess. If you could tell me more about your FireFox setup (how you have it configured, what plugins you are using, etc) then that would be helpful.

In the mean time, I'm going to watch the logs and see how widespread this issue is.

JKJ-FZ6

UTC

details

Ossessionato

BV400, Primavera 150, Yamaha Zuma 125

Joined: UTC
Posts: 4815
Location: Twin Cities, Minnesota

JKJ-FZ6

Ossessionato

BV400, Primavera 150, Yamaha Zuma 125

Joined: UTC
Posts: 4815
Location: Twin Cities, Minnesota

UTC quote

jess wrote:

If you could tell me more about your FireFox setup (how you have it configured, what plugins you are using, etc) then that would be helpful.

Windows 11: Firefox 140.0.4, "out of the box", no additional extensions or plugins.
Manjaro Linux: Firefox 139.0, SponsorBlock for Youtube extension, but this was installed after the 403 error started.

I don't see how Firefox could be to blame, because I get the same error at the same time when I try to log on with my iPhone, IOS 18.5. I can log in with the phone if I use mobile data and bypass my router.

If it makes any difference, I'm using a Nokia router on T-Mobile Fiber Internet, with no special security features etc. that I'm aware of. The router works perfectly with all sites other than Modern Vespa.

At the moment, I can log in to MV on my desktop computer.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

JKJ-FZ6 wrote:

I don't see how Firefox could be to blame, because I get the same error at the same time when I try to log on with my iPhone, IOS 18.5. I can log in with the phone if I use mobile data and bypass my router.

Once the IP is banned because of one device, then any device using that IP will also be banned. The real question is: which device actually triggered the ban, and why? I think in the logs, it looks like it happened with FireFox.

JKJ-FZ6 wrote:

If it makes any difference, I'm using a Nokia router on T-Mobile Fiber Internet, with no special security features etc. that I'm aware of. The router works perfectly with all sites other than Modern Vespa.

Probably unrelated to the router itself, but thanks for the info.

JKJ-FZ6 wrote:

At the moment, I can log in to MV on my desktop computer.

That's definitely good news! And if you do get stuck, ping me at: support@modernvespa.com

BajaRob

UTC

details

Ossessionato

1961 VS5T, 1981 P200E, 2003 Malaguti F12 Phantom,Rigid Frame Chopper, 2001 Harley FXDXT

Joined: UTC
Posts: 2170
Location: Ventura, CA

BajaRob

Ossessionato

1961 VS5T, 1981 P200E, 2003 Malaguti F12 Phantom,Rigid Frame Chopper, 2001 Harley FXDXT

Joined: UTC
Posts: 2170
Location: Ventura, CA

UTC quote

Well, now I'm getting the forbidden and the scanning screen at different times. I can usually get out of it by pushing the back button. Sometimes it takes 3 to four times for it to clear. Im using Android and Chrome. The screens come up after I click on MV then try to click onto a category. It hasn't kept me from getting on yet and I haven't noticed it happening while I'm logged in. Im not bitching but just letting you know what's going on. Hope this helps.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

BajaRob wrote:

Seeing "scanning" is normal and expected if you're not logged in. But it should only last about half a second, and then load the page. I take it the page isn't loading? What do you see instead?

(Screenshots could be helpful)

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 39740
Location: Bay Area, California

UTC quote

Again, my apologies to anyone who is adversely affected. Bots are an especially egregious scourge right now, and there are clearly cases where the system I have built to weed through and separate the bots from the legitimate users is failing.

I really don't want to give up and just let the bots scrape 20 years of data, over and over again, ad nauseam. But clearly, some browsers don't behave as I expect them to.

Not sure what to do.

For anyone who *is* affected, it's helpful to see a screenshot of the specific failure -- or at least whether it says "403 Forbidden" or whether it says something else. Also, it helps if you can recall (roughly) the sequence of events that led up to the failure -- such as "I opened my browser and clicked the bookmark", or "I browsed a few pages while logged out" or whatever.

Thanks again, all, for your patience.

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 39740 Location: Bay Area, California	UTC quote As if things weren't already bad enough, now the browser extensions have been turned into web-scraping machines. https://arstechnica.com/security/2025/07/browser-extensions-turn-nearly-1-million-browsers-into-website-scraping-bots/ This is really bad. I'm ready to throw in the towel.

Post Reply

Modern Vespa is the premier site for modern Vespa and Piaggio scooters. Vespa GTS300, GTS250, GTV, GT200, LX150, LXS, ET4, ET2, MP3, Fuoco, Elettrica and more.

Modern Vespa is made possible by our generous supporters.

Shop on Amazon with Modern Vespa

Modern Vespa is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to amazon.com

[ Time: 0.0123s ][ Queries: 3 (0.0039s) ][ live ][ 343 ][ ThingOne ]