1

I have been customizing all error pages in my Apache project. Everything seemed to be ok until 403 Forbidden Error appeared. When I send a wildcard character through the URL (such as a blank space or an asterisk), the custom error page is not displayed.

http://localhost:8080/*

If 403 Error is caused by another reason (for example accessing a forbidden file) this error does not appear and the custom error page is loaded correctly. My ".htaccess" code is:

ErrorDocument 403 /index.php/%{REQUEST_URI}

Anyone having the same problem? How can I solve it? Can I disable the special chars in order to avoid that error? Any answer is appreciated.

javierhersan
  • 13
  • 5

1 Answers1

0

When I send a wildcard character through the URL (such as a blank space or an asterisk), the custom error page is not displayed.

Aside: A "blank space" isn't a wildcard character, but if the requested URL-path starts with a space (ie. %20 when URL encoded) then this is indeed an invalid request - see #1 below.

There are two issues here...

  1. Apache will trigger a 403 early if there are certain invalid characters (eg. *, :, ") in the URL-path. In some respects this is OS dependent. If the character is not permitted in filenames (according to the underlying OS) then a 403 is triggered when the request is mapped to the filesystem.

  2. This occurs before .htaccess is processed. So if you define the ErrorDocument late in .htaccess then your custom error document is not called. However, if you define the ErrorDocument early in the server config (or VirtualHost) then this should get called.

Aside:

ErrorDocument 403 /index.php/%{REQUEST_URI}

You don't need to explicitly pass the requested URL to your index.php script. In PHP, this is available in the $_SERVER['REDIRECT_URL'] superglobal from within the error document.

Note that the $_SERVER['REQUEST_URI'] PHP superglobal is not necessarily the same as the similarly named REQUEST_URI Apache server variable. The PHP variable contains the query string, whereas the Apache variable does not.

MrWhite
  • 11,643
  • 4
  • 25
  • 40
  • Thank you, your answer has been very useful. It works perfectly on my localhost. But, what can I do if I don't have access to Apache configuration files? – javierhersan Sep 07 '19 at 19:16
  • If you don't have access to the server config then there is nothing you can do I'm afraid. – MrWhite Sep 07 '19 at 23:32