Modsecurity: 403 Forbidden

[RayBB]

Problem

https://openlibrary.org/books/OL51439179M/Problem_with_Solutions
https://webfiles.ucpress.edu/coverimage/isbn13/9780520402676.jpg

When I upload the above cover to the above editions I get a 403.

Reproducing the bug

1. Go to ...
2. Do ...

• Expected behavior:
• Actual behavior:

Context

• Browser (Chrome, Safari, Firefox, etc):
• OS (Windows, Mac, etc):
• Logged in (Y/N):
• Environment (prod, dev, local): prod

Breakdown

Implementation Details (for maintainers)

Requirements Checklist

• [ ]

Related files

Stakeholders

• @cdrini @mekarpeles

---

Instructions for Contributors

• Please run these commands to ensure your repository is up to date before creating a new branch to work on this issue and each time after pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

[mekarpeles]

⚠️ Contributors, this issue will be ready to work on once:

• Needs: Investigation — root cause is unknown; the 403 may originate from nginx/ModSecurity (see 403 Forbidden on author edit page #12632 and 403 Forbidden on work/edition edit pages #12677), the OL application layer, or an external server blocking the coverstore's URL fetch

Context

• Issues 403 Forbidden on author edit page #12632 and 403 Forbidden on work/edition edit pages #12677 (both filed and closed in May 2026) traced 403 Forbidden errors on author and work/edition edit pages to a ModSecurity misconfiguration. This upload 403 may be the same pattern or a distinct root cause.
• add_cover.POST() in openlibrary/plugins/upstream/covers.py:67–68 raises a 403 only when the authenticated user is flagged as read-only — this would not apply to a staff account.
• Cover uploads submitted via URL pass the source URL to the coverstore (/b/upload2), which fetches the image from the external host. If webfiles.ucpress.edu returns a 403 to the coverstore's fetch (e.g., due to User-Agent or hotlink protection), that error may propagate back as a cover upload failure. Whether the 403 matches an nginx error page or an application-level response is key to isolating the layer.

Issue Assessment

Open questions

• Is the 403 originating from OL's nginx/ModSecurity (producing an nginx-style error page) or from the OL application (which would show application-rendered messaging)?
• Does the same 403 occur when uploading a local file (not a URL) to the same edition?
• Does webfiles.ucpress.edu return 200 in a browser but 403 when fetched server-side (e.g., User-Agent or Referer filtering)?

Action items

• Complete the "Reproducing the bug" section: step-by-step repro, expected vs. actual behavior, browser, and OS
• Confirm whether this is nginx-level or application-level (check response headers or server logs)
• Test with a local file upload to isolate whether the issue is specific to the URL upload path

Full triage checklist (maintainers / Pam)

• Triage — correct labels applied or removed: Needs: Breakdown, Needs: Investigation, Needs: Design, Needs: Staff Decision, Needs: Staff / Admin, Good First Issue, Blocked, Blocker
• Problem / opportunity — problem is clear, audience identified, actionable
• Scope — issue is well-scoped; does not try to do too many things; split suggested if needed
• Justification — reasoning and impact stated; sufficient for leads to prioritize (note: does it include urgency / why now?)
• Success & testing criteria — defines what "done" looks like, verifiable by a contributor without asking; what must be tested
• Proposal & breakdown — concrete plan present; checklist or sub-issues actionable for a contributor
• If bug: environment & repro steps — browser, OS, local vs prod; steps to reproduce; actual vs expected behaviour — prod confirmed, but browser/OS/repro steps are unfilled template placeholders
• Risks, concerns, open questions — identified and surfaced (note: any security or privacy implications? if so, apply Blocker)
• Pam context — relevant code, commits, PRs reviewed; no duplicate issue found
• References — screenshots present

Note

This comment was automatically generated by Pam, Open Library's Project AI Manager, on behalf of @mekarpeles. Pam is designed to provide status visibility, perform basic project management functions and relevant codebase research, and provide actionable feedback so contributors aren't left waiting.

[Armansiddiqui9]

@RayBB I was able to upload the cover during testing and the upload was successful. This suggests the problem is either intermittent, or account based, or related to server side filtering/rate limiting.

[RayBB]

Still hitting this error on this book. @Armansiddiqui9 I am using the copy/paste method to upload. Were you doing that or uploading the file directly?