Can not Errordocument 403 on banned IP's

[Frank_Rizzo]

I have the following set in httpd.conf

--------------------------------

ErrorDocument 403 /error_3.html

--------------------------------

If a visitor tries to access a non directoryable part of the site such as /widgets/ they get served my custom 403 error page.

That works great. But what about visitors who I have banned?

--------------------------------

<Directory "/home">

<Files ~ "^.*$">
order allow,deny
allow from all

#09-May-07
deny from 123.123.123.123

</Files>
</Directory>

--------------------------------

If that IP visits the site it gets served the standard 403 and can not be served the custom page because they are banned from the site! What happens is this is displayed:

"Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request."

How do I get around this?

[jdMorgan]

Change the 'Order' priority so that Allows can override Denys, and then allow for error page and robots.txt requests:

SetEnvIf Request_URI "^/error_3\.html$" allowit
SetEnvIf Request_URI "^/robots\.txt$" allowit
<Files *>
Order Deny,Allow
Deny from 123.123.123.123
Allow from env=allowit
</Files>

If robots.txt requests are denied, some spiders may treat that as if the robots.txt file were blank, and make many more requests. Therefore, I recommend allowing unconditional robots.txt access, as well as 403-page access.

Note that we're using mod_setenvif and the capability of Allow and Deny in mod_access to take an environment variable as an argument here.

Jim

[Frank_Rizzo]

That looks as if it will do the trick.

One other thing I had tried was this:

ErrorDocument 403 http : // www .myotherwidgetsite.com/error_3.php

This is a good alternative as it gets around the ability to not server 403's to banned IP's - it also stops the main site logfile filling up.

This works in that banned IP's are redirected to the other site and served the error page but they do not receive a 403 status header.

Whilst this is fine for real visitors I don't think spamloggers will detect that their misdemeanour failed (if they bother checking return headers at all that is).