API calls return 403 because of RewriteRule

  • Resolved VolkerHarz

    (@volkerharz)


    2 years, 3 months ago

    The default ban list in Configure > Lockouts > Ban Users adds a bunch of lines to the .htaccess

    I had to comment out the line in my .htaccess because API Calls to my site were being blocked. But I’m unsure what this line actually does…

    RewriteRule ^.* - [F,L]

    Could someone please enlighten me?
    Thank you!

Viewing 3 replies - 1 through 3 (of 3 total)

  • Hi @volkerharz,

    A rewrite rule consists of the following structure:

    RewriteRule Pattern Substitution [Flags]

    RewriteRule: specifies the RewriteRule directive
    Pattern: a PCRE (Perl Compatible Regular Expression) that matches the desired string. You can learn more about regular expressions here.

    ^ -> Called an anchor, matches the beginning of the string
    . -> Matches any single character
    * -> Repeats the previous match zero or more times

    Substitution: where should the matching requests be sent

    A dash (-) means do nothing.

    [Flags]: optional parameters to modify the rule. For more information on the available flags and their meanings, see Apache’s documentation on Rewrite Flags.

    [F]
    Forbidden: instructs the server to return a 403 “Forbidden” response to the client.
    [L]
    Last rule: instructs the server to stop rewriting after the preceding directive is processed.

    Most likely the API Calls HTTP_USER_AGENT is empty which triggers the RewriteRule.(RewriteCond %{HTTP_USER_AGENT} “^$” [NC,OR]).

    +++++ To prevent any confusion, I’m not iThemes +++++

    • This reply was modified 2 years, 3 months ago by nlpro.
    • This reply was modified 2 years, 3 months ago by nlpro.
    • This reply was modified 2 years, 3 months ago by nlpro.
    • This reply was modified 2 years, 3 months ago by nlpro.
    • This reply was modified 2 years, 3 months ago by nlpro.
    Thread Starter VolkerHarz

    (@volkerharz)

    Hi @nlpro you’re awesome! Thank you!

    Most likely the API Calls HTTP_USER_AGENT is empty which triggers the RewriteRule.(RewriteCond %{HTTP_USER_AGENT} “^$” [NC,OR]).

    Totally makes sense now. Thanks.

    Edit: Seems i have to a deactive the default ban list as ithemes keeps overwriting .htaccess.

    • This reply was modified 2 years, 3 months ago by VolkerHarz.
    • This reply was modified 2 years, 3 months ago by VolkerHarz.
    Thread Starter VolkerHarz

    (@volkerharz)

    The default ban list can of course stay activated.
    The solution is, to simply add a User-Agent to the header of the call.

    Commenting out the line and leaving the default-ban list activated won’t work as it will be overwritten again by iThemes.

    +++++ To prevent any confusion, neither am I iThemes +++++ ??

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘API calls return 403 because of RewriteRule’ is closed to new replies.