I seem to be getting 403 forbidden errors when using assets.

I can see this happening in firebug when I try to index folders and if I try to upload a new file, it simply shows an alert saying 'undefined'.

Rooting around in the mcp.assets file I tried echoing the member_id from:


and it gave me '0' - so perhaps it's not getting the session value for some reason?

If I change the field to the native EE File field, I can upload the files successfully.

I just migrated servers, so it's probably something connected to that as I had it working before. I've tried uninstalling and re-installing the module with no joy.

I'm on Assets 2.1.3 and EE 2.6.1 on a server running PHP 5.3.25

Any suggestions would be great!

  • Tim, have you double checked permissions for your system/expressionengine/cache and assets subfolders? Also, have you looked at your server error logs? It may have a hint as to what that 403 server error is really all about - that's normally a security error. Lastly, are you seeing any JS errors in your browser's debug console? – Lisa May 28 '13 at 18:07
  • Permissions for cache and cache/assets (and its sub-folders) were all 777. No obvious clues in php or apache server error logs... but it does seem to be a session issue with the latest build of expressionengine. If I change the 'user session type' to 'cookies only' this seems to resolve the issue. Was also having a similar issue with logging in using zoo visitor until changing to 'cookies only' - seems to be an EE thing. – Tim Jukes May 28 '13 at 18:45
  • Forgot to mention - this was the same in both my development and live environments so I don't think it's to do with server settings. Any thoughts on what the session issue might be? Many thanks! – Tim Jukes May 28 '13 at 18:50
  • Tim, are Super Admin and FTP access available to this site? And it would still help very much to know if the server error logs reported anything in conjunction with that 403, even if it's the same in both environments. – Lisa May 28 '13 at 18:52
  • Thanks! I'll set you up with a super admin and FTP shortly - now I've got it sort-of working, there's a couple of things I need to do for the client first. Where should I email the details? – Tim Jukes May 28 '13 at 20:46

Issue appears to be with User Session Type in Security and Settings.

Ensuring that:

Control Panel Session Type = Cookies and Session ID 
User Session Type = Cookies only

seems to fix the issue for me. Flipping the user session type to Cookies and Session ID made the error recur on my setup.

I seemed to be running into issues with sessions on other extensions so the 403 issue appears to be a symptom of a possibly wider issue and not Assets-specific.

| improve this answer | |
  • I had the same problem and resolution. Weird. – 4midori Jan 19 '15 at 21:24
  • I've just gone through the same problem and this fixed it for me too. – Paul Frost Jun 27 '16 at 10:47

This problem may also occur if you have two domains pointing to same expression engine site and you are trying to access asset thru the domain which is not setup as your default domain in expression engine setting(Admin -> General Configuration -> URL to the root directory of your site OR Admin -> System Administration -> Cookie Settings -> Cookie Domain). Since you are not accessing asset thru default website domain your request will not be authenticated.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.