xmlHTTP Request returns 403 in FireFox when Post used

F

FMDeveloper

Currently transitioning from a shared host to a dedicated server. The
same code that works on the old server is not working on the dedicated
server. It is a simple AJAX request like:

<code>
function createXMLHttpRequest() {
if (window.ActiveXObject) {
xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
}
else if (window.XMLHttpRequest) {
xmlHttp = new XMLHttpRequest();
}
}


function doRequestUsingPOST() {
createXMLHttpRequest();
var queryString = "response.php?";
queryString = queryString + createQueryString() ;
xmlHttp.onreadystatechange = handleStateChange;
xmlHttp.open("POST", queryString, true);
xmlHttp.send(null);
}
</code>

With the code as is above, the requests works fine in IE. With Firefox
it throws a 403 on the page. A call to the response.php page with
parameters runs correctly outside of AJAX. Changing all POST requests
to GET resolves the issue, but I would prefer not to have to change
ALL POST requests to GET requests.

Does anyone know of a setting on the new server that can cause FireFox
(1.5.x and 2.0.x) to return a 403 with an AJAX post call?
 
M

Martin Honnen

FMDeveloper said:
Does anyone know of a setting on the new server that can cause FireFox
(1.5.x and 2.0.x) to return a 403 with an AJAX post call?
Click to expand...

The server sends that HTTP response status code. Check whether
responseText contains details why the request is forbidden.
 
F

FMDeveloper

The server sends that HTTP response status code. Check whether
responseText contains details why the request is forbidden.
Click to expand...

The responseText only contains the 403 error message from the server
 
P

pcx99

FMDeveloper said:
Currently transitioning from a shared host to a dedicated server. The
same code that works on the old server is not working on the dedicated
server. It is a simple AJAX request like:

<code>
function createXMLHttpRequest() {
if (window.ActiveXObject) {
xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
}
else if (window.XMLHttpRequest) {
xmlHttp = new XMLHttpRequest();
}
}


function doRequestUsingPOST() {
createXMLHttpRequest();
var queryString = "response.php?";
queryString = queryString + createQueryString() ;
xmlHttp.onreadystatechange = handleStateChange;
xmlHttp.open("POST", queryString, true);
xmlHttp.send(null);
}
</code>

With the code as is above, the requests works fine in IE. With Firefox
it throws a 403 on the page. A call to the response.php page with
parameters runs correctly outside of AJAX. Changing all POST requests
to GET resolves the issue, but I would prefer not to have to change
ALL POST requests to GET requests.

Does anyone know of a setting on the new server that can cause FireFox
(1.5.x and 2.0.x) to return a 403 with an AJAX post call?
Click to expand...

Pretty sure you're getting that error because you didn't set the ajax
header to indicate you were sending data as a post. After your
xmlHttp.open place the following line...

xmlHttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");

If you're not sending anything -- and since you have send(null) you're
not sending any data -- (because posts are sent via xmlHttp.send(data))
then you don't need to use post and get would work quite nicely.
 
I

Ian Collins

pcx99 said:
Pretty sure you're getting that error because you didn't set the ajax
header to indicate you were sending data as a post. After your
xmlHttp.open place the following line...

xmlHttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");

If you're not sending anything -- and since you have send(null) you're
not sending any data -- (because posts are sent via xmlHttp.send(data))
then you don't need to use post and get would work quite nicely.
Click to expand...

I'm sure you only have to set the Content-type on post requests if there
is data being sent.
 
F

FMDeveloper

Then check the server's error log.
Click to expand...

No further hint in the log that I can see. The relevant part is below:

63.202.xxx.xxx - - [02/Apr/2007:16:10:33 -0700] "GET /includes/
styles.css HTTP/1.1" 200 3437 "http://host.com/adjustment.php"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/
20070309 Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:34 -0700] "GET /adjustment.php
HTTP/1.1" 200 78514 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-
US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:35 -0700] "GET /favicon.ico HTTP/
1.1" 200 1150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:
1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:37 -0700] "GET /finder.php?row=1
HTTP/1.1" 200 3984 "http://host.com/adjustment.php" "Mozilla/5.0
(Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/
2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:37 -0700] "GET /includes/
style.css HTTP/1.1" 200 1027 "http://host.com/finder.php?row=1"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/
20070309 Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:39 -0700] "GET /response.php?
brand=19&ts=1175555465215 HTTP/1.1" 200 1757 "http://host.com/
finder.php?row=1" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:
1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:40 -0700] "POST /listing.php?
brand=19&size=11L-16&ts=1175555466434 HTTP/1.1" 403 652 "http://
host.com/finder.php?row=1" "Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"

I changed the first AJAX call to a get and it works. The same type of
call as a post fails.
 
F

FMDeveloper

Then check the server's error log.
Click to expand...

No further hint in the log that I can see. The relevant part is below:

63.202.xxx.xxx - - [02/Apr/2007:16:10:33 -0700] "GET/includes/
styles.css HTTP/1.1" 200 3437 "http://host.com/adjustment.php"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/
20070309Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:34 -0700] "GET/adjustment.php
HTTP/1.1" 200 78514 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-
US; rv:1.8.1.3) Gecko/20070309Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:35 -0700] "GET/favicon.ico HTTP/
1.1" 200 1150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:
1.8.1.3) Gecko/20070309Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:37 -0700] "GET/finder.php?row=1
HTTP/1.1" 200 3984 "http://host.com/adjustment.php" "Mozilla/5.0
(Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309Firefox/
2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:37 -0700] "GET/includes/
style.css HTTP/1.1" 200 1027 "http://host.com/finder.php?row=1"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/
20070309Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:39 -0700] "GET/response.php?
brand=19&ts=1175555465215 HTTP/1.1" 200 1757 "http://host.com/
finder.php?row=1" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:
1.8.1.3) Gecko/20070309Firefox/2.0.0.3"
63.202.xxx.xxx - - [02/Apr/2007:16:10:40 -0700] "POST/listing.php?
brand=19&size=11L-16&ts=1175555466434 HTTP/1.1" 403 652 "http://
host.com/finder.php?row=1" "Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8.1.3) Gecko/20070309Firefox/2.0.0.3"

I changed the firstAJAXcall to agetand itworks. The same type of
call as apostfails.
Click to expand...

Adding xmlHttp.setRequestHeader("Content-type","application/x-www-form-
urlencoded"); did not solve the issue.

An example url that would be placed into queryString in
xmlHttp.open("Post", queryString, true) is
http://www.host.com/listing.php?brand=13&size=11.00-20&ts=1175560027602
 
P

pcx99

Ian said:
I'm sure you only have to set the Content-type on post requests if there
is data being sent.
Click to expand...


Ah well, it was worth a guess.

Hmm 403. If it was 405 then it would be because he was trying to post
to a static file (not php or server-side program). With 403 he may be
running into apache's mod_security which tries to filter out some hack
attempts.

I'd disable mod_security for a few mins and try to post with it
disabled. I know a few of my articles which deal with htaccess I need
to disable mod_security to upload them through the browser and if I
forget I get a 403 error.

You can disable the code by editing .htaccess and adding the following
lines (assuming your web-host allows this).

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

After you're done either remove the lines or insert a # in front of each
line to comment it out.
 
P

pcx99

pcx99 said:
Ah well, it was worth a guess.

Hmm 403. If it was 405 then it would be because he was trying to post
to a static file (not php or server-side program). With 403 he may be
running into apache's mod_security which tries to filter out some hack
attempts.

I'd disable mod_security for a few mins and try to post with it
disabled. I know a few of my articles which deal with htaccess I need
to disable mod_security to upload them through the browser and if I
forget I get a 403 error.

You can disable the code by editing .htaccess and adding the following
lines (assuming your web-host allows this).

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

After you're done either remove the lines or insert a # in front of each
line to comment it out.
Click to expand...

And it works in IE so it's unlikely to be an .htaccess problem.
Frustrating problem. In another post he said adding the header didn't
fix the problem. I'd still try the .htaccess change because its quick
and easy to check (assuming he's running apache), but other than that
I'm stumped (<<< usual condition).
 
I

Ian Collins

pcx99 said:
Ah well, it was worth a guess.

Hmm 403. If it was 405 then it would be because he was trying to post
to a static file (not php or server-side program). With 403 he may be
running into apache's mod_security which tries to filter out some hack
attempts.
Click to expand...
He doesn't say which server he is using and the log didn't look like an
Apache error log.
I'd disable mod_security for a few mins and try to post with it
disabled. I know a few of my articles which deal with htaccess I need
to disable mod_security to upload them through the browser and if I
forget I get a 403 error.
Click to expand...
It's odd, because I use these style of requests all the time and haven't
hit this error.
 
F

FMDeveloper

All I can suggest is you look at the request packets on the wire and
compare the headers sent by each browser.
Click to expand...

Running Apache 1.3.37 - mod_security is disabled, so I will test that
now
 
F

FMDeveloper

Running Apache 1.3.37 - mod_security is disabled, so I will test that
now
Click to expand...

THANKS FOR ALL YOUR HELP GUYS! It does appear that mod_security on
Apache 1.3.37 will cause FireFox to return a 403 with the code sample
I provided. Disabling mod_security allows all of the posts to work.
 
B

blaine

Hey,

The guys above pointed a lot of stuff out. However since you are doing
a POST with ajax your xmlHttp.send should be the post parameters not a
null value. Even though you've specified a post your request is sent
like a get..

A proper post would be as below..

function doRequestUsingPOST() {
createXMLHttpRequest();
var postURL = "response.php";

xmlHttp.onreadystatechange = handleStateChange;
xmlHttp.open("POST", postURL, true);

//createQueryString returns something like
//name=<name>&address=<address>&variable3=<variable3> etc etc
xmlHttp.send( createQueryString() );
}
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Problems With XMLHTTP Request. 4
Spring Boot Request Mapping: How to Handle Multiple Request Paths in a Controller 1
In Firefox null gets assigned before XHR returns. Works in IE. 9
JS ajax request 15
Trouble submitting POST ajax request on Chrome: INVALID_STATE_ERR:DOM Exception 11 2
XMLHTTP - null is null or not an object 0
Query about displaying xmlhttp output 5
XMLHTTP 4

Members online

No members online now.
Total: 43 (members: 0, guests: 43)
Robots: 187

Forum statistics

Threads
473,764
Messages
2,569,564
Members
45,040
Latest member
papereejit

Latest Threads

Top