Since today, every POST request with Content-Type: multipart/form-data to my
website returns “403 Forbidden – openresty”. Until yesterday the same forms
worked normally.
Other Information
Website: svcgthanhbinh.info.vn
What I tested (requests sent from a normal browser session on the site):
multipart/form-data to ANY path returns 403 openresty, including “/”,
/admin/login.php and /admin/vlog_actions.php, even when the body is a
single empty text field with no file at all.
The same requests sent as application/x-www-form-urlencoded (or text/plain)
work normally and reach PHP, including bodies containing HTML and bodies
around 200 KB.
So PHP and my scripts are fine; the request is blocked before it reaches
the server. Because of this, all file uploads and every form with a file
input on my site are broken (saving posts, cover images, gallery uploads).
One possible trigger: one of my PHP files contained the text of a PEM
private-key header (“BEGIN EC PRIVATE KEY”) as a format template in code
(no actual key in it). I have removed that string from the file. If my
account was automatically flagged because of it, could you please review
and lift the restriction?
Is there an account-level flag or a new filter on multipart uploads?
Thank you very much!
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
Is the same multipart/form-data POST also blocked on your free subdomain under page.gd, the other site on this account? If it works there but fails on svcgthanhbinh.info.vn, the block is tied to that one domain. If it fails on both, it applies to the whole account or the server.
On your question about a flag: the account is active and shows no current restriction. Its only suspension was in September, for hits, and it was lifted the next day. I couldn’t find an article or staff answer that describes a filter on multipart uploads, or one that blocks requests because of text like a private-key header in a file. So I can’t say what is causing the 403.
When I try to register a new product or save changes to an existing product in my custom PHP/MySQL admin panel, I receive a 403 Forbidden — openresty error.
The website loads normally, but both product creation and product editing fail when submitted. The application worked before, and I suspect this may be related to the multipart/form-data POST issue reported today.
Could you please investigate whether requests to my hosting account are being blocked before reaching PHP?
that also happend to me, last time i edit my site, all working normal, today at 7pm i just realize, i cant do anything related to saving into database, edit(update) stil work, but adding new data always 403
The registration page loads normally, but clicking Create Account returns 403 Forbidden — openresty. The same PHP code works correctly on my local XAMPP server. The error happens even when no profile picture is selected.
Could you please check whether my hosting account is affected by the same restriction?