I have a template containing a tag from a custom module that processes POST'd data from an external site, but when the page is called it responds with a 403 error (so the logs from the external site tell me anyway).

If I remove the tag, the page will display, but with the tag in it I get an empty page.

Changing the request to a GET is not an option.

EE : v2.5.2


Well, is really not too much info you provide to us (what EE version, what module etc.). But I can suggest that it is results of Cross-site Request Forgery protection. Possible you do not provide csrf_token/xid with your POST.

Just for test - try to disable it in config.php

$config['secure_forms'] = 'n'; // for EE <2.8
$config['disable_csrf_protection'] = 'y'; // for EE >=2.8

It is also good to know what exactly was on the page, not just header data. Because it can be EE 403 error because of protection, but it can be server info also. For example - do you have mod_security on server? What status of SecFilterEngine?

  • config.php has this: $config['csrf_protection'] = FALSE, I assume that means it's disabled already.
    – wot
    May 22 '14 at 11:33
  • ok, I see your ee version now - try to add $config['secure_forms'] = 'n'; into you config for test.
    – Max Lazar
    May 22 '14 at 12:09
  • I also add additional info into post.
    – Max Lazar
    May 22 '14 at 12:23
  • I added $config['secure_forms'] = 'n'; it didn't help though
    – wot
    May 22 '14 at 12:54
  • mod_security is installed on my server and it caused a different issue recently, so it is now turned off.
    – wot
    May 22 '14 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.