htaccess 403 Forbidden error was encountered while trying to use an ErrorDocument

Question

I want to have a custom 403 page in my project. So I added these codes in a .htaccess file:

Order deny,allow
Deny from all
Allow from 192.168.1.0/24

ErrorDocument 403 /403.htm

But when the project runs from an out of rang IP, and 403 error must be occurred, custom 403 page redirect does not work and I give another error too.

Forbidden

You don't have permission to access /app/ on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

What is this problem for? I have read different articles inside StackOverflow and other websites, but none of them could not solve this problem.

Solution

The problem is that the deny from all denies everything including the error documents.

But hey, .htaccess files work in cascade, so you can

1. create a subfolder in your web root (assuming your webroot is /www - /www/errordocs
2. => in there put your ErrorDocuments like 403.html etc.
3. create another .htaccess there - /www/errordocs/.htaccess
4. => into this /www/errordocs/.htaccess put allow from all
5. In the main .htaccess in the webroot (/www/.htaccess ) put
   ErrorDocument 403 /errordocs/403.html etc..

If this is still not working for you, check there are public/others/everyone READ permissions on both the folder and the file

/www/errordocs => 755
/www/errordocs/.htaccess => 640
/www/errordocs/403.html => 644

Don't be confused - Windows OS also has permissions, you will need at least Read permissions for Everyone on these, more on the Windows permissions here.

Just remember, files in this folder will all be public! (don't put there anything you don't want public :-)

Comments

[Mohammad Saberi]

I am running this project on Windows. So there is no such permission issue on it.

[Pranav Deshpande]

@MohammadSaberi usually on server when we deploy project , there are some permission issues on web folder , on windows it must be read only ... that why it is throwing error , as .htaccess file rewrites this folder

[jave.web]

In 99% cases setting 777 / allow everybody everything permissions is not the correct solution, max permissions you should ever set are 775, ideally no more than 755 but there are a few hosts where you need 775