Error 403 forbidden when change status of page (The JSON response of the API could not be parsed)

The CMS Questions
1

Hi there,

I’m hosting on my server a lot of website (+100) with different CMS, every environment are chrooted with jailkit (Jailkit - chroot jail utilities) for environement isolation, and I have one of this website working with Kirby CMS.

The website globaly “works”, but some backend function doesn’t. It doesn’t work when we try to change status of a basic page (from “draft” to “listed”). This error occur each time :

Capture d’écran de 2023-09-04 11-49-45
Capture d’écran de 2023-09-04 11-49-451230×702 36 KB

After some research, I found that this POST request “https://xxxxx.fr/api/pages/test/status” happen when I try to change page status, and it give me a 403 forbidden. So I think this is an error from my Apache server configuration. When I check the error log with debug log, I got :

[Mon Sep 04 11:52:52.882989 2023] [authz_core:debug] [pid 31108] mod_authz_core.c(820): [client xxx.xxx.xxx.xx:58312] AH01626: authorization result of Require ip 127.0.0.1: denied
[Mon Sep 04 11:52:52.882997 2023] [authz_core:debug] [pid 31108] mod_authz_core.c(820): [client xxx.xxx.xxx.xx:58312] AH01626: authorization result of <RequireAny>: denied
[Mon Sep 04 11:52:52.883002 2023] [authz_core:error] [pid 31108] [client xxx.xxx.xxx.xx:58312] AH01630: client denied by server configuration: /path/to/env/htdocs/public/api

I don’t understand why Kirby try /public/api (this folder doesn’t exist) and why it give me “Require ip 127.0.0.1” when my Apache configuration is just in “Require all granted”…

I search for many hours now, without any result… I’m losing my mind. Do you have an idea ?

Thanks !

2

Hi, just to complete my post, here are the software version I’m using :

debian 10.13
Apache/2.4.38
Kirby 3.7

3

So where in your config is the Require IP 127.0.0.1 statement? Could you post your Apache config?

Did you already try to raise the log level and what was the outcome?

4

Hi,

Thank you for your answer.

This is my problem : I don’t find “Require ip 127.0.0.1” anywhere…

Here is my Apache config for this vhost (it’s pretty basic)

<VirtualHost *:443>
    ServerName www.xxxxxxx-xxxx.fr
    ServerAlias www.xxxxxxx-xxxx.fr.xxxx.xxxx.com
    include conf/rewrite_robots_disallow.conf 
    include conf/prohibit_git.conf
    ServerAlias  xxxx-xxxx.fr
    ServerAdmin webmaster@xxxx.xxxx

    SSLEngine On
    SSLCertificateFile      /etc/ssl/letsencrypt/certs/www.xxxx-xxxx.fr.xxxx.xxxx.com/cert.pem
    SSLCertificateKeyFile   /etc/ssl/letsencrypt/certs/www.xxxx-xxxx.fr.xxxx.xxxx.com/privkey.pem
    SSLCertificateChainFile /etc/ssl/letsencrypt/certs/www.xxxx-xxxx.fr.xxxx.xxxx.com/chain.pem

    DocumentRoot /var/virtual_www/xxxx-xxxx.fr/www.xxxx-xxxx.fr/htdocs/public
    php_value engine off
    
    <FilesMatch \.php$>
      SetHandler "proxy:unix:/var/run/php7.4-www.xxxx-xxxx.fr.sock|fcgi://localhost"
    </FilesMatch>
    
    <Directory /usr/lib/cgi-bin >
      AllowOverride None
      Require all granted
    </Directory>
    
    SuexecUserGroup www.xxxx-xxxx.fr xxxx-xxxx.fr
    LogLevel debug
    
    ErrorLog /var/virtual_www/xxxx-xxxx.fr/www.xxxx-xxxx.fr/logs/xxxx-error.log 
    CustomLog /var/virtual_www/xxxx-xxxx.fr/www.xxxx-xxxx.fr/logs/xxxx-access.log combined
    ScriptAlias /cgi-bin/ /var/virtual_www/xxxx-xxxx.fr/www.xxxx-xxxx.fr/cgi-bin/
    
    <Directory "/var/virtual_www/xxxx-xxxx.fr/www.xxxx-xxxx.fr/htdocs/public">
      Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch -Indexes
      AllowOverride All
      Require all granted      
    </Directory>
    
</VirtualHost>

For the log, do you mean Apache log / Kirby log / both of them ?

5

I mean the Apache log.

Are you sure, that the directive does not appear in the remaining config? Configuration items do also appear in the main config file and might appear in additional config files and associated to modules.

6

Ok the problem is solved.

You were right, the cause was a bad Apache configuration with a Require ip that match a specific location (used by our monitoring system)
I didn’t find it in the first way because I made a grep with case sensitive and the require was writing without caps… so stupid.

Thanks you for your help anyway!