Project

General

Profile

Actions

Bug #86346

closed

Hidden pages sent 403 Header

Added by Sascha Egerer over 5 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Frontend
Target version:
-
Start date:
2018-09-21
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

When trying to access a hidden page a 403 Header is sent. This has been introduced in #23178
As a hidden page from the frontend view does not exist, it must sent a 404 header and not a 403 which means it is not accessible due to missing authentication


Related issues 6 (1 open5 closed)

Related to TYPO3 Core - Bug #23178: Wrong HTTP headers sent when trying to access pages that require loginClosedMarkus Klein2010-07-14

Actions
Related to TYPO3 Core - Feature #53813: Different redirects for different error types in "Page not found" handlingClosed2013-11-20

Actions
Related to TYPO3 Core - Bug #88957: ID was not an accessible page - on hidden pages although the 404 error handler is configured in the site configClosed2019-08-14

Actions
Related to TYPO3 Core - Bug #82036: Missing use of pageNotFound_handling in TypoScriptFrontendController.php, only PageNotFoundException is used.Closed2017-08-03

Actions
Related to TYPO3 Core - Bug #92762: Accessing a restricted subpage of a sysfolder triggers a 404 instead of 403Closed2020-11-03

Actions
Related to TYPO3 Core - Bug #102122: Hidden pages sent 403 HeaderNew2023-10-09

Actions
Actions #1

Updated by Sascha Egerer over 5 years ago

  • Related to Bug #23178: Wrong HTTP headers sent when trying to access pages that require login added
Actions #2

Updated by Markus Klein over 5 years ago

"Funny". Reading my patch 10 month later, I realize the wording of "accessible" does not reflect the actual "forbidden" state, but also all the other enable fields.
That's very unfortunate.

On the other hand: The page does exist, you just don't have access if it is hidden or expired. So semantically that's not really wrong. Do you see any SEO consequences?

Actions #3

Updated by Sascha Egerer over 5 years ago

Yes, Google throws lots of “could not access page anymore” errors.

From the Frontend point of view they do not exist. There is no way from the frontend to make them accessible so I would that a 404 must be used.

Actions #4

Updated by Markus Klein over 5 years ago

Okay, so we need to revert #23178. Unfortunate, but necessary.

Actions #5

Updated by Sascha Egerer over 5 years ago

Markus Klein wrote:

Okay, so we need to revert #23178. Unfortunate, but necessary.

Are you sure? I think we do still need some parts of it. The code must just not be 403 for disabled pages but still for non accessible pages (due to frontend group restriction)

Actions #7

Updated by Markus Klein over 5 years ago

  • Related to Feature #53813: Different redirects for different error types in "Page not found" handling added
Actions #8

Updated by Markus Klein over 5 years ago

Technically we can't distinguish those cases currently code-wise. The reason why a page can't be accessed is hidden quite deep in the code. It needs a good amount of refactoring to preserve the reason until the final header is sent.

Actions #9

Updated by Urs Braem over 5 years ago

Maybe related (?): for some custom extbase records, when not existing, I get a 303 immediately followed a redirect to the central 404 page (which then throws the correct 404)
https://www.gendercampus.ch/de/aktuelles/neuigkeiten/nonexistingrecord

Actions #10

Updated by Christian Eßl about 4 years ago

  • Category set to Frontend
Actions #11

Updated by Susanne Moog about 4 years ago

  • Related to Bug #88957: ID was not an accessible page - on hidden pages although the 404 error handler is configured in the site config added
Actions #12

Updated by Susanne Moog about 4 years ago

  • Related to Bug #82036: Missing use of pageNotFound_handling in TypoScriptFrontendController.php, only PageNotFoundException is used. added
Actions #13

Updated by Johannes Seipelt about 4 years ago

For disabled pages I managed to show the content of the 404 error page the same way its used in my site-configuration (multi-site and multi-language) with this added to my AdditionalConfiguration.php (v9):

if (preg_match('/\/en\//', $_SERVER['REQUEST_URI']) || $_GET['L'] == 1) {
    $GLOBALS['TYPO3_CONF_VARS']['FE']['pageNotFound_handling'] = '/en/404/';
} else {
    $GLOBALS['TYPO3_CONF_VARS']['FE']['pageNotFound_handling'] = '/de/404/';
}

The status code 403 is ofc still wrong in that case but atleast i can show content to the user and not just the error page (Page Not Found Reason: ID was not an accessible page)
What would be a better way to get it right? these options have been removed in v10 and iam still trying to understand why i can set a error page for 403 with pageNotFound_handling, didnt TYPO3 distinguish between 403/404 in the past? To just set the ErrorHandling for 403 in the site-configuration to the same handling as 404 doesnt seem right to me.

Actions #14

Updated by Gerrit Code Review over 3 years ago

  • Status changed from New to Under Review

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/58829

Actions #15

Updated by Gerrit Code Review over 3 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/58829

Actions #16

Updated by Gerrit Code Review over 3 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/58829

Actions #17

Updated by Gerrit Code Review over 3 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/58829

Actions #18

Updated by Gerrit Code Review over 3 years ago

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65815

Actions #19

Updated by Oliver Hader over 3 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #20

Updated by Benni Mack over 3 years ago

  • Status changed from Resolved to Closed
Actions #21

Updated by Rémy DANIEL over 3 years ago

  • Related to Bug #92762: Accessing a restricted subpage of a sysfolder triggers a 404 instead of 403 added
Actions #22

Updated by Gerrit Code Review over 3 years ago

  • Status changed from Closed to Under Review

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66906

Actions #23

Updated by Gerrit Code Review over 3 years ago

Patch set 2 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66906

Actions #24

Updated by Gerrit Code Review over 3 years ago

Patch set 3 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66906

Actions #25

Updated by Gerrit Code Review over 3 years ago

Patch set 4 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66906

Actions #26

Updated by Gerrit Code Review about 3 years ago

Patch set 5 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66906

Actions #27

Updated by Benni Mack over 2 years ago

  • Status changed from Under Review to Closed
Actions #28

Updated by Evelin no-lastname-given 7 months ago

  • Related to Bug #102122: Hidden pages sent 403 Header added
Actions

Also available in: Atom PDF