Randomly 403 HTTP Status from IIS

Question

Randomly 403 HTTP Status from IIS

Francis Garnier 0

Hi, I have an ASP.NET WebForms application (4.7.2) who run from long time. Since some days, for one ASPX page (always the same), users randomly (I think) receive 403 status. I activate trace on IIS (10) and I see this detail : MODULE_SET_RESPONSE_ERROR_STATUS - Warning ModuleName="ManagedPipelineHandler", Notification="EXECUTE_REQUEST_HANDLER", HttpStatus="403", HttpReason="Forbidden", HttpSubStatus="0", ErrorCode="The operation completed successfully. (0x0)", ConfigExceptionInfo="" On the Microsoft documentation, the substatus 0 is not mentionned. And then I compare this 403 trace with a 200 trace of the same page, I see differences in AspNetHttpHandler events. Trace 403 has less events than trace 200. Trace 403 :

Trace 200 :

I don't know where to search next. The errors occurs in production 3 or 4 time per day. Any ideas how can I go further ? I'm lost... Thank you

AgaveJoe 30,126 Reputation points

2024-02-14T11:45:30.3933333+00:00

403 (Forbidden) means the server received and understands the request but application logic is not allowing access to a resource.
403 Forbidden We often see this error when the URL path points to a directory that does not contain a default page like default.aspx page.

for one ASPX page (always the same), users randomly (I think) receive 403 status.

You did not share the URL or any code so we have less information than you. Plus it seem you are not sure if the 403 is related to the unknown aspx page. The first thing I would do is get the URL that causes the 403.
Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2024-02-15T01:27:41.01+00:00

FRT clearly indicates that the status code came from ASP.NET side, so no more IIS docs can be helpful right now. Like @AgaveJoe suggested, follow the page that gave you such 403 errors and the source code, and you might be able to figure out the culprit yourself.
Francis Garnier 0 Reputation points

2024-02-15T09:53:46.21+00:00

Thank you @AgaveJoe and @Lex Li (Microsoft) . The URL is ok because the 403 error occurs only few times per day. The error can't be related to an unknown aspx page (by the way, you can see in the trace in my post that the page is reconized given that it contains AspNet events). When I compare the two traces (403 and 200), I see that in the 403 trace, AspNet event stops after PageLoadLeave. So, to go further, I override netx events in my page and in each of them, I add logs and try/catch around the call to base. Because nothing in the code of the page can throw a 403 error.

2 answers

Your answer

AgaveJoe 30,126 Reputation points

2024-02-14T11:45:30.3933333+00:00

403 (Forbidden) means the server received and understands the request but application logic is not allowing access to a resource.
403 Forbidden We often see this error when the URL path points to a directory that does not contain a default page like default.aspx page.

for one ASPX page (always the same), users randomly (I think) receive 403 status.

You did not share the URL or any code so we have less information than you. Plus it seem you are not sure if the 403 is related to the unknown aspx page. The first thing I would do is get the URL that causes the 403.
Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2024-02-15T01:27:41.01+00:00

FRT clearly indicates that the status code came from ASP.NET side, so no more IIS docs can be helpful right now. Like @AgaveJoe suggested, follow the page that gave you such 403 errors and the source code, and you might be able to figure out the culprit yourself.
Francis Garnier 0 Reputation points

2024-02-15T09:53:46.21+00:00

Thank you @AgaveJoe and @Lex Li (Microsoft) . The URL is ok because the 403 error occurs only few times per day. The error can't be related to an unknown aspx page (by the way, you can see in the trace in my post that the page is reconized given that it contains AspNet events). When I compare the two traces (403 and 200), I see that in the 403 trace, AspNet event stops after PageLoadLeave. So, to go further, I override netx events in my page and in each of them, I add logs and try/catch around the call to base. Because nothing in the code of the page can throw a 403 error.

Answer 1

Francis Garnier 0

As I say in my comment, since the IIS trace in 403 case don't have some ASP.NET page events, I override these events in my page and add a log and a call to base in each of them. Then I have a status 403, all these logs (OnPreRender, OnPreRenderComplete and OnSaveStateComplete) are not prensent. How can I go further to find why these events are not executing ?

Sam Wu-MSFT 7,561 Reputation points Microsoft External Staff

2024-02-16T09:38:45.23+00:00

@Francis Garnier It is difficult to reproduce your problem based on your description, I suggest you open a case via: https://support.microsoft.com, one of our engineers will help find the root cause.

Answer 2

Francis Garnier 0

Thank you for all ideas and response. Finally, the 403 was returned by our application (we use an opaque private framework...). The problem is now corrected.

Share via

Randomly 403 HTTP Status from IIS

2 answers

Your answer