My favorites | Sign in
Project Home Wiki Issues Source
New issue   Search
  Advanced search   Search tips   Subscriptions
Issue 482: r1736 - Intermittent 403 for optimized subresources
3 people starred this issue and may be notified of changes. Back to list
Status:  Closed
Closed:  Jun 2013

Sign in to add a comment
Reported by, Jul 27, 2012
What steps will reproduce the problem?
1. Vhost, single server configuration as a reverse proxy for HTML and forward-proxy for the fetcher
2. Core Filters
3. After optimizations, sub resources result in a 403 intermittently.  No logic to what results in a 403 and what results in a 200.  You need a page full of resources to see the problem.

You can take any webpage in a single server environment.

The error log displays the following(disregard the localhost VIP, I tested the fetcher grabbing directly from the origin):
[Sat Jul 28 05:02:39 2012] [error] [client] client denied by server configuration: uri /images/ajax-loader.gif.pagespeed.ce.vhzt6XKJwT.gif, referer:
[Sat Jul 28 05:02:39 2012] [debug] net/instaweb/apache/ [client] ModPagespeed OutputFilter called for request /images/ajax-loader.gif.pagespeed.ce.vhzt6XKJwT.gif, referer:
[Sat Jul 28 05:02:39 2012] [debug] net/instaweb/apache/ [client] Request not rewritten because: request->status != 200 (was 403), referer:

More data:
The fetcher never actually tries to make a fetch.  I've traced the requests and the fetcher needs make a successful request for the subresource which leads me to believe that there might be a configuration problem or bug.

What version of the product are you using (please check X-Mod-Pagespeed
r1736 - I've seen this in the last few revisions.

On what operating system?
Ubuntu 10.04

Which version of Apache?
Apache 2.2.22

Which MPM?

URL of broken page:

Jul 30, 2012
Project Member #1
"client denied by server configuration" comes from mod_authz_host --- that's the thing that handles things like 'allow from localhost'.  I suspect we don't even get to handle_as_resource (in, which is the part of our code that should handle it; if we did, you should probably see debug logs like:
"Fetching resource /images/ajax-loader.gif.pagespeed.ce.vhzt6XKJwT.gif", 
followed by something like "Fetch failed for " or "Fetched timed out for"
unless we failed to recognize the request as ours.

Why it would be intermittent is weird, though; that module should at least behave consistently per url, unless it does something really weird (env, perhaps?)
Jul 30, 2012
Okay, we tried some configurations added this bit into the vhost conf and that seems to fix the problem.  It is odd that we were experiencing intermittent issues with this however.

   <Location "/">                                                                                 
      Include /trustedIPs.conf

We'll this a bit more testing and report back.
Aug 15, 2012
Project Member #3
Let us know if you want us to do something on this, Hayes.

Status: RequestClarification
Aug 20, 2012
Project Member #4
(No comment was entered for this change.)
Status: Started
Sep 10, 2012
Project Member #5
(No comment was entered for this change.)
Sep 19, 2012
I'm also seeing this issue, though it isn't intermittent. Any request to pagespeed optimized resources results in a 403 error, unless apache has been set to allow requests by default starting with the root directory as shown below. The issue doesn't seem to occur in v1870. 

<Directory />
 #Order Deny,Allow
 #Deny from all
  Order allow,deny
  Allow from all
Dec 11, 2012
Project Member #7
Daniel, we are investigating various 403 issues in more detail at the moment.

Can you provide details of your setup please? What servers are you running, what's in your httpd.conf and pagespeed.conf, and anything else you think relevant.

Status: RequestClarification
Jan 30, 2013
Project Member #8
daniel@ please try the latest release ( to see if it fixes your problem.
If not, please try building from source (

There have been a number of recent fixes addressing 403 errors.
Jun 26, 2013
Project Member #9
Marking as Closed: the OP has a fix/work-around and Daniel hasn't provided further details.
Status: Closed
Sign in to add a comment

Powered by Google Project Hosting