.htaccess blocks GET *.js file with net::ERR_ABORTED 403 (Forbidden)

[Aristotelis Joannou]

Hi people,

An htaccess file in a directory allows access to the js and css files contained within if accessed directly.

ALLOWED:

https://mydomain.com/catalog/view/extension/related_options/js/liveopencart.related_options.js

However when accessed with the pagespeed format link, it is forbidden:

FORBIDDEN:

https://mydomain.com/catalog/view/extension/related_options/js/liveopencart.related_options.js,qv=1555453574,av=3.0.37.pagespeed.jm.706ouQx3D8.js

If I remove the htaccess file, the link above is now allowed.

Here is the htaccess file.

Order allow,deny

Deny from all

<FilesMatch "(?i)((\.css|\.js))">

Allow from all

</FilesMatch>

How do I modify this to allow the forbidden link above? I tried some mods but no joy.

[Longinos]

Hi

I don´t know how apache work with the regexp in htaccess, but the difference in these url is that the pagespeed rewrite has 2 (.js).

Perhaps searching only for the string (.js) at the end of the line works.

<FilesMatch "(?i)((\.css$|\.js$))">

Allow from all

</FilesMatch>

[Aristotelis Joannou]

I just tried it and it still 403 - forbidden.

This is very weird. 

Any other suggestions?

[Longinos]

Hi

What means this qv=1555453574,av=3.0.37 in the url?

These not come from pagespeed

[Aristotelis Joannou]

I really do not know. 

I can guess about 3.0.37 - it looks like the version of Journal 3.x theme for opencart

[Aristotelis Joannou]

This is the output from Show Metadata Cache: 

Metadata cache key:rname/jm_MChm-KqYTHPrk4TYFhUC/https://mydomain.com/catalog/view/extension/related_options/js/liveopencart.related_options.js?v=1555453574&v=3.0.37@@_

cache_ok:true

can_revalidate:false

partitions:partition {

  optimizable: true

  url: "https://mydomain.com/catalog/view/extension/related_options/js/liveopencart.related_options.js,qv=1555453574,av=3.0.37.pagespeed.jm.706ouQx3D8.js"

  input {

    index: 0

    type: FILE_BASED

    last_modified_time_ms: 1555453574000

    filename: "/home/mydomain/public_html/catalog/view/extension/related_options/js/liveopencart.related_options.js"

  }

}

[Aristotelis Joannou]

looks like the first number is the last modified time?

[Joshua Marantz]

Definitely looks like your AllowFrom expression for .js files might not allow for query-params at the end of a .js filename, but the syntax in it stretches my regex-fu.

Can you try something like this?

<FilesMatch "(\.css|\.js)[\?.]">

I haven't tested this, but I'm trying to express: "a file with a .css or .js extension, optionally followed by a "?" and then anything else".

On Mon, Jul 22, 2019 at 12:13 AM Aristotelis Joannou <aristotel...@gmail.com> wrote:

looks like the first number is the last modified time?

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/7a674e46-e7d7-4187-b513-c2b9f81ad78a%40googlegroups.com.

[Aristotelis Joannou]

No luck my friend.

[Aristotelis Joannou]

any ideas?

[Longinos]

Hi

Can you share any url to test it?

In the url of the page that contais these .js files add https://mydoamin/page/?PageSpeedFilters=+debug and take a look into the html code.

This inject debug messages in the html code and may be you get any clue.

El miércoles, 24 de julio de 2019, 4:35:56 (UTC+2), Aristotelis Joannou escribió:

any ideas?

[Aristotelis Joannou]

I tried the debugging link but I could not detect anything.

You can test this error at this url >>>(link)<<<.

[Longinos]

Hi

If you disable the combine_javascript filter, the you got 3 js files with the issue:

https://static.fashionvega.com/catalog/view/extension/live_price/js/liveopencart.live_price.js,qv=1554165719,av=3.0.37.pagespeed.jm._jJSNC-K3Q.js

https://static.fashionvega.com/catalog/view/extension/related_options/js/liveopencart.related_options.js,qv=1557951709,av=3.0.37.pagespeed.jm.2cp09VE8TB.js

https://static.fashionvega.com/catalog/view/extension/live_price/js/liveopencart.live_price.js,qv=1554165719,av=3.0.37.pagespeed.jm._jJSNC-K3Q.js

Whe the filter is active, you got only 1 file with the issue:

https://static.fashionvega.com/catalog/view/extension/related_options/js/liveopencart.related_options.js,qv=1557951709,av=3.0.37.pagespeed.jm.2cp09VE8TB.js

In both cases, this file got requested 2 times.

So the problem, for me, is related with the file path "extension/related_options/js/" cause the files are served when this path is not present or maybe related with the parameters.

The original url have 2 "v=" , 1 seems the version (3.0.7) and 1 seems a sort of timestamp.

Can you edit the files to make the timestamp don´t appear?

P.S. To enable/disable combine_javascript don´t need to change config files and re-star, only add it to the url parameters:

https://www.fashionvega.com/?PageSpeedFilters=+debug,-combine_javascript

[Aristotelis Joannou]

Hi 

Good observations.

1. I cannot change the script functionality to make the timestamp to not appear. These are not my own scripts. All 3 of them belong to an Opencart extension called Related Options.

2. All 3 of them function OK without pagespeed.

3. With pagespeed, I have to disable the .htaccess file, otherwise we get errors.

4. I think it has something to do with the "comma" after ".js" - I think pagespeed functions OK only if there is '?' after ".js"

what do you think?

[Longinos]

 Hi

3.- Why you do need to disable the .htacces file? What is their content? what errors happens?

4.- I think is not related. The original file has ?v= then when is rewrited pagespeed changes it with ,qv

https://static.fashionvega.com/catalog/view/extension/live_price/js/liveopencart.live_price.js?v=1554165719&v=3.0.37 thi`s the original url from one of them,

and when the js file get combined it not trow any error and has these , in it.

I even thought maybe the issue was related to have 2 params with the same name (v=) but when the file is combines, there are the 2 params with the same name and don´t trow any error.

This make me think is more related with the file path "extension/related_options/js/" .

Maybe is there any other .htacces around? in any folder of this path "extension/related_options/js/"? what happens if you don´t use any .htacces for these files?

[Aristotelis Joannou]

Hi Longinos,

3. 

The .htaccess file is in my first post. 

It is installed by this opencart extension in these folders:

/mystore/catalog/view/extension/live_price/.htaccess

/mystore/catalog/view/extension/related_options/.htaccess

If I do not use pagespeed, I do not get any errors even with the .htaccess files in place.

When I use pagespeed I get the errors you already can see - in order to NOT get any errors I have to remove the .htaccess files.

Since you can see these errors with pagespeed, this means that the htaccess files are both in place.

This is purely pagespeed not playing nice with htaccess.

There are no other htaccess files except of course my main one at the root of my website.

[Joshua Marantz]

HI -- I want to take a different approach to this challenge. My suspicion is that OpenCart messes around with URLs, via some combination of mod_rewrite statements and JavaScript URL manipulation. This is in conflict with PageSpeed and the way that it rewrites URLs with CoreFilters.

I think your best course of action is to retreat slightly and enable pagespeed's OptimizeForBandwidth mode. Please read the link, enable that mode, and let us know if that helps.

Thanks!

-Josh

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/c83007db-5ce4-4027-a76f-a8844dc505fc%40googlegroups.com.

[Aristotelis Joannou]

I just tried it and it does not happen with:

ModPagespeedRewriteLevel OptimizeForBandwidth

In order to make the comparison as equivalent as possible, I enabled/disabled all the following filters.

ModPagespeedDisableFilters in_place_optimize_for_browser

ModPagespeedEnableFilters add_head

ModPagespeedEnableFilters combine_css,combine_javascript,

ModPagespeedEnableFilters convert_gif_to_png,convert_jpeg_to_progressive,convert_jpeg_to_webp,convert_meta_tags,convert_png_to_jpeg,convert_to_webp_lossless

ModPagespeedEnableFilters extend_cache,extend_cache_css,extend_cache_images,extend_cache_scripts

ModPagespeedEnableFilters fallback_rewrite_css_urls,flatten_css_imports,inline_css

ModPagespeedEnableFilters inline_images,inline_import_to_link,inline_javascript

ModPagespeedEnableFilters jpeg_sampling,recompress_images,recompress_jpeg,recompress_png,recompress_webp,resize_images,resize_rendered_image_dimensions

ModPagespeedEnableFilters rewrite_css,rewrite_images,rewrite_javascript,rewrite_javascript_external,rewrite_javascript_inline,rewrite_style_attributes_with_url

ModPagespeedEnableFilters strip_image_color_profile,strip_image_meta_data

Does this mean that I cannot use CoreFilters and I have to use all these filters mentioned above?

[Joshua Marantz]

Some of the CoreFilters need to change URLs which looks like it's in conflict with OpenCart.

I would start by only specifying the OptimizeForBandwidth directive and nothing else. Then you can see if you want to try to enable additional filters.

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/70e7bfce-02da-4df2-81f5-3a1bc95b1c04%40googlegroups.com.

[Aristotelis Joannou]

ok JM thanks