When I open this URL in Chrome, it returns “POST required”, as expected. However, when my Android app sends a multipart POST request with a Firebase ID token in the Authorization header, the server returns HTTP 403 with an HTML error response.
Could you please help me determine whether this POST request is being blocked by the hosting security system?
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
Yes, this is most likely the hosting security system. Every free hosting account has a check that only lets through clients that can run JavaScript and accept cookies. Android apps can’t do that, so the request is stopped before it reaches your PHP code. Chrome works because it’s a real browser. The article lists mobile apps and REST APIs as things that won’t work on free hosting, and 403 Forbidden as a common error for blocked requests.
The article is here:
To check that it’s this and not something in your own code, look at the HTML body the app gets back with the 403. If it mentions aes.js or “This site requires Javascript to work”, the security system stopped it. If it’s something else, please post the body here.
The article says this check can’t be turned off for a single URL or for an app. Premium hosting uses less restrictive protection that allows apps and APIs.