Modern Vespa : HTTP/1.1 403 Forbidden

HTTP/1.1 403 Forbidden

OP Matchlessman UTC details Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 721 Location: UK
OP Matchlessman Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 721 Location: UK	UTC quote I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone?

Max6200 UTC details Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA
Max6200 Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA	UTC quote Matchlessman wrote: I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone? You're being punished by the Vespa gods

OP Matchlessman UTC details Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 721 Location: UK
OP Matchlessman Addicted PK50XL, PK100S, ET3, Matchless G80S, Honda CBR400RR, Ducati ST4S Joined: UTC Posts: 721 Location: UK	UTC quote Max6200 wrote: You're being punished by the Vespa gods It'll be yellow boots next.

Max6200 UTC details Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA
Max6200 Banned 2006 GTS 250 Joined: UTC Posts: 10590 Location: KS USA	UTC quote Matchlessman wrote: It'll be yellow boots next. Don't you forgot it. It's a major award which makes me a major member in my head.

Halijaro UTC details Molto Verboso '99 PX200 & GTS300 HPE SuperSport Joined: UTC Posts: 1486 Location: Cheshire, England, UK.
Halijaro Molto Verboso '99 PX200 & GTS300 HPE SuperSport Joined: UTC Posts: 1486 Location: Cheshire, England, UK.	UTC quote Matchlessman wrote: I'm getting a HTTP/1.1 403 Forbidden error when trying to use chrome. Firefox works ok. Do i need to clear my cache or something like that, or have i upset someone? Same for me on Chrome desktop. Fine using Chrome on phone though (Android).

fledermaus UTC details Veni, Vidi, Posti 2007 LX150 2015 GTS 2017 BV 350 Joined: UTC Posts: 12485 Location: Fond du Lac, Wisconsin
fledermaus Veni, Vidi, Posti 2007 LX150 2015 GTS 2017 BV 350 Joined: UTC Posts: 12485 Location: Fond du Lac, Wisconsin	UTC quote Yeah, kinda weird. I'm fine on my phone...

Shebalba UTC details Molto Verboso 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 1821 Location: Oceanside, CA
Shebalba Molto Verboso 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 1821 Location: Oceanside, CA	UTC quote I have also been 'dubbed thee unforbidden.' It's only Chrome.. I sacrificed my soul and tried Edge and everything is fine.. safari on my phone is also fine. Or I wouldn't be posting this.

JimVanMorrissey UTC details Addicted Vespa PX200 Joined: UTC Posts: 583 Location: Belgrade
JimVanMorrissey Addicted Vespa PX200 Joined: UTC Posts: 583 Location: Belgrade	UTC quote Same issue with Chrome here. Thought it might be my IP (I'm in Serbia, kinda dodgy) but no, seems to be a global problem.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

UTC quote

There are a variety of things that can trigger a 403 Forbidden error. Is there any other informative text below the 403?

How long has it been happening? What were you doing when it first happened?

One potential reason for a 403 error is if a lot of requests are made in a very short amount of time -- the server is protecting itself against bots. Obviously, you all are not bots, but it is possible that Chrome is doing something that makes the server think it's a bot.

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote I'm using Chrome right now (on macOS) and not seeing any obvious problems. I'd really like to hear more about what specific activities are involved.

SteelBytes

UTC

details

Veni, Vidi, Posti

2019 GTS 300 HPE SuperTech 71,000km

Joined: UTC
Posts: 7147
Location: Batmania aka Melbourne, Aus

SteelBytes

Veni, Vidi, Posti

2019 GTS 300 HPE SuperTech 71,000km

Joined: UTC
Posts: 7147
Location: Batmania aka Melbourne, Aus

UTC quote

jess wrote:

I'm using Chrome right now (on macOS) and not seeing any obvious problems. I'd really like to hear more about what specific activities are involved.

broken on Brave on Windows (both computers that I tried), works on Brave on Android. This is posted using Edge on the same computer.

I did nothing. Just got out of bed, picked up my laptop, walked to the cafe and tried to surf MV while drinking my liquid breakfast. No go.

here's the details from brave

request
------
Request URL: https://modernvespa.com/forum/new
Request Method: GET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-AU,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: mv_token=XXXXXXXXXXXX (removed)
Host: modernvespa.com
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Brave";v="110"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Sec-GPC: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110

response
-----
Status Code: 403 Forbidden
Remote Address: 50.18.170.78:443
Referrer Policy: strict-origin-when-cross-origin
Connection: Keep-Alive
Content-Length: 132
Content-Type: text/html; charset=UTF-8
Date: Thu, 09 Mar 2023 08:04:31 GMT
Keep-Alive: timeout=5, max=99
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache/2.4.54 () OpenSSL/1.0.2k-fips PHP/7.4.33
X-Frame-Options: SAMEORIGIN
X-Powered-By: PHP/7.4.33

<html>
<head>
<title>403 Forbidden</title>
</head>
<body>
<h1>HTTP/1.1 403 Forbidden</h1>
<p></p>
</body>
</html>

Positive

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote SteelBytes wrote: here's the details from brave Thanks for that. It doesn't tell me a lot, but it does tell me that the error is being returned from the application layer (the forum software) rather than some lower-level server component. The funny thing is that nothing on the server has actually changed for weeks.

SteelBytes

UTC

details

Veni, Vidi, Posti

2019 GTS 300 HPE SuperTech 71,000km

Joined: UTC
Posts: 7147
Location: Batmania aka Melbourne, Aus

SteelBytes

Veni, Vidi, Posti

2019 GTS 300 HPE SuperTech 71,000km

Joined: UTC
Posts: 7147
Location: Batmania aka Melbourne, Aus

UTC quote

jess wrote:

Thanks for that. It doesn't tell me a lot, but it does tell me that the error is being returned from the application layer (the forum software) rather than some lower-level server component.

The funny thing is that nothing on the server has actually changed for weeks.

did a bit more digging ...

ya know when you press F12 and get the debugging tab (forget the name) there is a button that lets you make it emulate different devices - eg pretend to be an iphone 12 or a pixel 5 etc. if I turn on that button and refresh it then works (turn off and refresh and it breaks again). So I looked at the headers during that and it doesn't include the "sec-ch-xxx" set of headers (the other Sec-Fetch and Sec-GPS are still there)

Positive

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote Try regular chrome (with the default user agent) again and tell me if it works. (I removed a ban on a specific agent that was triggered by an overlimit client)

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Try regular chrome (with the default user agent) again and tell me if it works. (I removed a ban on a specific agent that was triggered by an overlimit client) don't have regular chrome handy (bit lazy to install it just for this test). Anyone else wanna check with regular Chrome?

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote SteelBytes wrote: don't have regular chrome handy (bit lazy to install it just for this test). Anyone else wanna check with regular Chrome? Or Brave.

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Or Brave. it works!

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote SteelBytes wrote: it works! Does Brave use the standard Chrome user agent?

SteelBytes UTC details Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus
SteelBytes Veni, Vidi, Posti 2019 GTS 300 HPE SuperTech 71,000km Joined: UTC Posts: 7147 Location: Batmania aka Melbourne, Aus	UTC quote jess wrote: Does Brave use the standard Chrome user agent? it says Chrome in it so ... guess so? SteelBytes wrote: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

UTC quote

SteelBytes wrote:

it says Chrome in it so ... guess so?

It's not the word Chrome that triggers it, it's the exact user agent string. It looks like the output you pasted in doesn't include the tail end of the user agent string, but the rest of it matches the problem user agent that was put in the penalty box for being overlimit (i.e. too many requests in a short amount of time).

There is a subset of malicious bots that uses constantly-changing IP addresses to barrage the server with requests, but uses the same user agent for all the requests. The code in question was trying to catch that behavior, but snagged all Windows Chrome users (presumably using the latest version) in the process.

I will have to rethink that aspect of session management. I've commented it out for now, so hopefully it won't snag any other innocent bystanders.

Thanks much for the assist.

JOHNTEE UTC details Hooked Vespa ET4 Joined: UTC Posts: 155 Location: Sheffield England
JOHNTEE Hooked Vespa ET4 Joined: UTC Posts: 155 Location: Sheffield England	UTC quote All back to normal now Positive

chandlerman

UTC

details

Innovator

76 Sprint V, 63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3

Joined: UTC
Posts: 11268
Location: Nashville

37 Days Since Last Explosion

chandlerman

Innovator

76 Sprint V, 63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3

Joined: UTC
Posts: 11268
Location: Nashville

37 Days Since Last Explosion

UTC quote

jess wrote:

Are you using WAF or CloudFront to get the Shield Basic protections? Either of those would protect you, albeit at a (potentially-minimal) cost. The default edge security just provides basic packet hygiene, so protection for IP Stack level stuff like syn floods.

Shebalba UTC details Molto Verboso 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 1821 Location: Oceanside, CA
Shebalba Molto Verboso 2009 GTS250, Ducati Monster M900, KTM 390 Adventure, Honda CR125 Joined: UTC Posts: 1821 Location: Oceanside, CA	UTC quote Also back up and running. I know zero about code, so thank you to SteelBytes for saying all of those computer words to Jess. And thank you to Jess who, I think, took all of the computer words from SteelBytes and resolved it. Positive

adri UTC details Atypical Canadian 2009 Vespa S50(LX150 motor swap), 2006 Vespa GTS250ie Joined: UTC Posts: 2319 Location: Toronto, Canada
adri Atypical Canadian 2009 Vespa S50(LX150 motor swap), 2006 Vespa GTS250ie Joined: UTC Posts: 2319 Location: Toronto, Canada	UTC quote About 24 hours on access for me either. Pretty sure Jess just banned us for some fun lol

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

UTC quote

chandlerman wrote:

We use CloudFront as a CDN for all the attachments and the other various non-dynamic assets (icons, fonts, images, etc). This keeps the load off the main server and means we can run a fairly lightweight main server instance. Plus, of course, all the images load faster around the world.

We don't use CloudFront on the main server (modernvespa.com) at all. Nor WAF. The defense mechanisms we use predate both CloudFront and WAF (by a lot) and have largely grown organically with the site. I'm not sure converting to WAF at this point would be straightforward -- it would be hard to capture all the different rules that I've put into place over the last (checks watch) 17 years.

I'll give it a closer look and see if it seems plausible, at least.

jess UTC details Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California
jess Petty Tyrant 0:7 and counting Joined: UTC Posts: 38578 Location: Bay Area, California	UTC quote adri wrote: About 24 hours on access for me either. Pretty sure Jess just banned us for some fun lol Yeah, not my idea of a good time.

chandlerman

UTC

details

Innovator

76 Sprint V, 63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3

Joined: UTC
Posts: 11268
Location: Nashville

37 Days Since Last Explosion

chandlerman

Innovator

76 Sprint V, 63 GL, 62 VBB, 05 Stella, 66 Smallstate, 66 Lammy S3

Joined: UTC
Posts: 11268
Location: Nashville

37 Days Since Last Explosion

UTC quote

jess wrote:

We don't use CloudFront on the main server (modernvespa.com) at all. Nor WAF. The defense mechanisms we use predate both CloudFront and WAF (by a lot) and have largely grown organically with the site. I'm not sure converting to WAF at this point would be straightforward -- it would be hard to capture all the different rules that I've put into place over the last (checks watch) 17 years.

I'll give it a closer look and see if it seems plausible, at least.

That makes sense. Assuming the main server is sitting behind an ALB or ELB, it would be pretty simple to turn WAF on. Unless the legacy protections are very site-specific, you'd probably find that those events Just Went Away with WAF turned on.

And not that I'm totally shilling for AWS (but, full transparency, I *do* work there) the cost of WAF would probably be near zero unless MV does a lot more traffic than I think.

jess

UTC

details

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

jess

Petty Tyrant

0:7 and counting

Joined: UTC
Posts: 38578
Location: Bay Area, California

UTC quote

chandlerman wrote:

That makes sense. Assuming the main server is sitting behind an ALB or ELB, it would be pretty simple to turn WAF on.

The main server is just a standard EC2 instance without any load balancing. And not a very big instance at that -- currently t4g.small.

chandlerman wrote:

Unless the legacy protections are very site-specific, you'd probably find that those events Just Went Away with WAF turned on.

Some of the protections are very site specific. We're running a very, very old (and very modified) version of phpBB2. Scripted forum attacks for phpBB2 and phpBB3 have been commonly used by spammers and other malicious actors, and I've found that altering the basic environment in ways that are unique to MV has kept us largely free of automated spam. The spam that does get through is manually posted by low-paid grunts, mostly in India these days.

chandlerman wrote:

And not that I'm totally shilling for AWS (but, full transparency, I *do* work there) the cost of WAF would probably be near zero unless MV does a lot more traffic than I think.

I'm actually a bit of an AWS fanboy, and have incorporated quite a few AWS services into the MV code in ways that would make it difficult to run MV on any other host. I'm comfortable with that.

I don't think the cost would be zero -- a brief look at the pricing chart for US West (Northern California) puts the cost at $5 per month and $1 per rule. I suspect the number of rules I would need would be the kicker, as phpBB's very old design distributes entry points across about a hundred different PHP files, each with subtly different requirements. It's a mess, actually. I'm still reading the docs to get a better sense of what WAF can do.

Post Reply

Modern Vespa is the premier site for modern Vespa and Piaggio scooters. Vespa GTS300, GTS250, GTV, GT200, LX150, LXS, ET4, ET2, MP3, Fuoco, Elettrica and more.

Modern Vespa is made possible by our generous supporters.

Shop on Amazon with Modern Vespa

Modern Vespa is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to amazon.com

[ Time: 0.0221s ][ Queries: 3 (0.0062s) ][ live ][ 334 ][ ThingOne ]