间歇性HTTP 403禁止错误调用相同的Ajax代码

Question

I use my JavaScript client (say, foo.js ) to call my php Ajax code in the server (say, bar.php ). 我用我的JavaScript客户端（比如， foo.js ）打电话给我的PHP Ajax代码在服务器（比如， bar.php ）。 This works perfectly most of the time, but once in a while I get back HTTP 403 (Forbidden) instead of the usual 200 (OK). 这在大多数情况下都能正常运行，但是偶尔我会返回HTTP 403（禁止访问），而不是通常的200（确定）。 This happens using exactly the same code, same parameters, etc. 使用完全相同的代码，相同的参数等会发生这种情况。

Why is that happening? 为什么会这样呢？ How can I fix it? 我该如何解决？ Is there a chance it's happening due to some action inside my bar.php code? 是否有可能由于我的bar.php代码内的某些操作而发生了这种情况？ How can I log the reason for it? 如何记录原因？

The foo.js client: foo.js客户端：

function postAjax(url, queryString, callback) {
  var x = new XMLHttpRequest();
  x.onreadystatechange = function() {
    if (x.readyState === 4) {  // 4=after HTTP response content finished loading
      if (x.status === 200) callback(true, x.responseText);
      else callback(false, x.status);
    }
  };
  x.open('POST', url, true);
  x.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
  x.setRequestHeader('Content-type','application/x-www-form-urlencoded');
  x.send(queryString);
}

var params = 'aaa=xxx&bbb=yyy';
postAjax('bar.php', params, myCallback);

function myCallback(ajaxStatus, ajaxResponse) { /* do something */ }

The bar.php server: bar.php服务器：

<?php
header('Content-Type: text/plain');
$isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest';
if ($isAjax) {
  /* Do something with $_POST['aaa'] and $_POST['bbb'] */
  echo 'Success';
}
else {
  echo 'Error';
}
?>

New info appended: 附加新信息：

Browser Console (in this example Firefox): 浏览器控制台（在此示例中为Firefox）：

When all is good (most of the time): 当一切都好时（大部分时间）：
+ POST http://example.com/bar.php 200 OK ZZZms + POST http://example.com/bar.php 200 OK ZZZms

When error (eg, after the 7th time the last I tried): 如果出现错误（例如，在我第七次尝试之后）：
+ POST http://example.com/bar.php 403 Forbidden X ZZZms + POST http://example.com/bar.php 403禁止X ZZZms
and I get back 403 in ajaxResponse, which comes from x.status 然后在ajaxResponse中返回403，它来自x.status

Expanding the '+' in the Firefox console, I see the response: 在Firefox控制台中展开“ +”，我看到响应：

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /bar.php
on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
</body></html>

Looking at the Apache Raw Accwss Log (thru cPanel), I see a similar POST row for all, with the status changed from 200 to 404 in the 7th test: 查看Apache Raw Accwss日志（通过cPanel），我看到了所有类似的POST行，在第7个测试中，其状态从200更改为404：

<my IP> - - [17/Jan/2015:09:55:50 -0500] "POST /bar.php HTTP/1.1" 404 - "<my test url>" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0"

"You don't have permission to access" ??? “您无权访问” ？？？
How come I have permission 6 times but not the 7th time? 为什么我有6次但没有7次获得许可？

Looking at the Apache Error Log (thru cPanel) for the same time, I see the row: 同时查看Apache错误日志（通过cPanel），我看到以下行：

[Sat Jan 17 09:55:50 2015] [error] [client <my IP>] File does not exist: /home/<my user>/public_html/403.shtml, referer: <my test url>

Answer 1

Did some thorough research. 做了一些彻底的研究。 It's... mod_security !!! 是... mod_security ！

Look at http://www.opensourceforu.com/2011/08/securing-apache-part-10-mod_security/ , search for 'SecFilterScanPOST'. 查看http://www.opensourceforu.com/2011/08/securing-apache-part-10-mod_security/ ，搜索“ SecFilterScanPOST”。 My 'aaa' posted variable serves as some random token, and once in a while had a value filtered by this mod_security mechanism. 我的'aaa'发布变量用作一些随机令牌，并且偶尔会有此mod_security机制过滤的值。

This was fixed following a chat with the host support. 在与主机支持人员聊天之后，此问题已修复。 Initially I thought I could solve it myself by editing some .htaccess file(s) appropriately, but eventually it appeared I needed their assistance. 最初，我认为自己可以通过适当地编辑一些.htaccess文件来解决此问题，但最终看来，我需要他们的帮助。

间歇性HTTP 403禁止错误调用相同的Ajax代码

问题描述

1 个解决方案

解决方案1
2 2015-01-17 17:22:08

间歇性HTTP 403禁止错误调用相同的Ajax代码

问题描述

1 个解决方案

解决方案1 2 2015-01-17 17:22:08

解决方案1
2 2015-01-17 17:22:08