You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Bennett Haselton <be...@peacefire.org> on 2010/07/25 04:38:58 UTC
[users@httpd] how to make ErrorDocument apply to https:// site as well?
In my httpd.conf file I added the directive (at the bottom of the
file, so at the top level):
ErrorDocument 403 /banned_ip.php
That works when I go to a file that I've set chmod to 000:
http://209.160.28.154/forbidden.txt
(of course the "banned IP" message doesn't make any sense in that
context where the real reason the file is forbidden is because its
permissions are 000, but I'm just testing the ErrorDocument directive)
But when I go to the https:// version of the same URL (after ignoring
the SSL cert error of course):
https://209.160.28.154/forbidden.txt
I see a generic "403 forbidden" instead of the error I specified in
ErrorDocument.
How do I make the ErrorDocument directive apply to my SSL site as
well? I've tried inserting "ErrorDocument 403 /banned_ip.php" into
ssl.conf at the top level, and into ssl.conf inside the <VirtualHost
_default_:443></VirtualHost> tags, but none of that worked.
-Bennett
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https://
site as well?
Posted by Bennett Haselton <be...@peacefire.org>.
Thanks, I had actually just realized that might work :)
Yes, putting this into .htaccess does the trick:
***
<Files banned_ip.php>
allow from all
</Files>
ErrorDocument 403 /banned_ip.php
order deny,allow
deny from 71.112.32.149
***
Now the real question is why, for http requests, it allowed me to
view the banned_ip.php error message, instead of saying that a 403
error occurred while trying to follow the ErrorDocument
directive. Apparently Apache applies some different set of rules to
the two situations, and I'll be damned if I can find anything in the
documentation that says why the two cases would behave
differently. For https requests, Apache applied the .htaccess
restrictions to the file listed in the ErrorDocument directive, and
for https requests it didn't.
-Bennett
At 07:33 PM 7/25/2010, Eric Covener wrote:
> > 2) in any case, if that is the cause, what would be the solution?
>
>You put a <Files> section inside of a <Directory> section and allow
>all IP addresses to access it (order deny,allow ; allow from all)
>
>--
>Eric Covener
>covener@gmail.com
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https:// site as
well?
Posted by Eric Covener <co...@gmail.com>.
> 2) in any case, if that is the cause, what would be the solution?
You put a <Files> section inside of a <Directory> section and allow
all IP addresses to access it (order deny,allow ; allow from all)
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https://
site as well?
Posted by Bennett Haselton <be...@peacefire.org>.
At 05:30 PM 7/25/2010, Eric Covener wrote:
> > A little more potentially useful information:
> > The 403 forbidden message that comes up when I try to access an
> https:// URL
> > also says:
> > "Additionally, a 403 Forbidden error was encountered while trying
> to use an
> > ErrorDocument to handle the request."
> >
> > So apparently Apache is *applying* the ErrorDocument directive to
> https://
> > requests, it's just not able to find the /banned_ip.php file when
> doing so.
>
>No, not "not able to find". How did you "ban" the IP
in /var/www/html/.htaccess
>and how do you
>expect Apache to be able to serve the errordocument for the banned IP?
Well, it works for http URLs -- when I go to this address from my
home IP (which is in the "banned" list), I see the banned_ip page
(note my browser does not get redirected, I stay on the URL below but
I see the contents of banned_ip.php):
http://209.160.28.154/
I assume that what you're saying is basically: Since my .htaccess
file denies access to my IP to any file underneath /var/www/html ,
why should I expect the server to be able to serve the contents of
banned_ip.php to me, and isn't that probably why I'm getting the
error for https:// URLs?
That makes sense, but:
1) like I said, it works for http URLs; and
2) in any case, if that is the cause, what would be the
solution? Move banned_ip.php to a higher-level location like
/var/www/banned_ip.php? The problem with that is that the path
specified for ErrorDocument has to be relative to the DocumentRoot,
which is /var/www/html . (And, putting "/../banned_ip.higher.php" in
the ErrorDocument directive to jump one directory higher, does not
work :) That just gives a 400 Bad Request error.)
> >
> > So since my directive says
> > ErrorDocument 403 /banned_ip.php
> > how come Apache can find that file when giving a 403 error in
> response to an
> > https request, but not in response to an http request?
>
>Maybe you punched a hole in your config to allow access to the file,
>but only in the non-SSL vhost?
Unfortunately this is on a machine that's completely clean and I
didn't make any other changes. So I don't know why Apache is able to
serve /var/www/html/banned_ip.php in response to 403 errors generated
by http requests but not https requests.
-Bennett
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https:// site as
well?
Posted by Eric Covener <co...@gmail.com>.
> A little more potentially useful information:
> The 403 forbidden message that comes up when I try to access an https:// URL
> also says:
> "Additionally, a 403 Forbidden error was encountered while trying to use an
> ErrorDocument to handle the request."
>
> So apparently Apache is *applying* the ErrorDocument directive to https://
> requests, it's just not able to find the /banned_ip.php file when doing so.
No, not "not able to find". How did you "ban" the IP and how do you
expect Apache to be able to serve the errordocument for the banned IP?
>
> So since my directive says
> ErrorDocument 403 /banned_ip.php
> how come Apache can find that file when giving a 403 error in response to an
> https request, but not in response to an http request?
Maybe you punched a hole in your config to allow access to the file,
but only in the non-SSL vhost?
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https://
site as well?
Posted by Bennett Haselton <be...@peacefire.org>.
At 07:38 PM 7/24/2010, Bennett Haselton wrote:
>In my httpd.conf file I added the directive (at the bottom of the
>file, so at the top level):
>
>ErrorDocument 403 /banned_ip.php
>
>That works when I go to a file that I've set chmod to 000:
>http://209.160.28.154/forbidden.txt
>
>(of course the "banned IP" message doesn't make any sense in that
>context where the real reason the file is forbidden is because its
>permissions are 000, but I'm just testing the ErrorDocument directive)
>
>But when I go to the https:// version of the same URL (after
>ignoring the SSL cert error of course):
>https://209.160.28.154/forbidden.txt
>I see a generic "403 forbidden" instead of the error I specified in
>ErrorDocument.
A little more potentially useful information:
The 403 forbidden message that comes up when I try to access an
https:// URL also says:
"Additionally, a 403 Forbidden error was encountered while trying to
use an ErrorDocument to handle the request."
So apparently Apache is *applying* the ErrorDocument directive to
https:// requests, it's just not able to find the /banned_ip.php file
when doing so.
So since my directive says
ErrorDocument 403 /banned_ip.php
how come Apache can find that file when giving a 403 error in
response to an https request, but not in response to an http request?
Presumably for http requests, Apache understands that
"/banned_ip.php" refers to the file "/var/www/html/banned_ip.php"
because of the
DocumentRoot "/var/www/html"
line in httpd.conf.
However, this is supposed to be inherited to the SSL host as well --
ssl.conf has these lines in the middle:
<VirtualHost _default_:443>
# General setup for the virtual host, inherited from global configuration
#DocumentRoot "/var/www/html"
#ServerName www.example.com:443
... etc. (And I tried uncommenting that "DocumentRoot" line in
ssl.conf to see if that fixed it, but that didn't work either.)
So why doesn't it work? The DocumentRoot directive is supposed to be
inherited to the SSL server, and with that inherited, it should
understand that "ErrorDocument 403 /banned_ip.php" refers to
/var/www/html/banned_ip.php , shouldn't it?
-Bennett
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https://
site as well?
Posted by Bennett Haselton <be...@peacefire.org>.
At 03:31 AM 7/25/2010, Simone Caruso wrote:
>>How do I make the ErrorDocument directive apply to my SSL site as
>>well? I've tried inserting "ErrorDocument 403
>>/banned_ip.php" into ssl.conf at the top level, and into ssl.conf
>>inside the <VirtualHost _default_:443></VirtualHost>
>>tags, but none of that worked.
>>
>>-Bennett
>(main conf):
>ErrorDocument 403 /403.html
>ErrorDocument 404 /404.html
>Alias /403.html /var/www/403.html
>Alias /404.html /var/www/404.html
Sorry, this didn't fix it. For http:// urls, I get the custom error
page, but for https:// urls, I still get the default "403 forbidden"
message instead of the custom error.
(In other words, his appears to have the same effect as the
ErrorDocument 403 /banned_ip.php
line that I had in httpd.conf before.)
-Bennett
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] how to make ErrorDocument apply to https:// site
as well?
Posted by Simone Caruso <in...@simonecaruso.com>.
> How do I make the ErrorDocument directive apply to my SSL site as well? I've tried inserting "ErrorDocument 403
> /banned_ip.php" into ssl.conf at the top level, and into ssl.conf inside the <VirtualHost _default_:443></VirtualHost>
> tags, but none of that worked.
>
> -Bennett
(main conf):
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
Alias /403.html /var/www/403.html
Alias /404.html /var/www/404.html
--
Simone Caruso
IT Consultant
p.iva: 03045250838
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org