Return custom 403 error page with nginx

Question

Im trying to display the error page in /temp/www/error403.html whenever a 403 error occurs.

This should be whenever a user tries to access the site via https (ssl) a

Answer 1

I did heaps of googling before coming here but did some more just now, within 5 minutes I had my answer :P

Seems I'm not the only person to have this issue:

error_page 403 /e403.html;
  location = /e403.html {
  root   html;
  allow all;
}

http://www.cyberciti.biz/faq/unix-linux-nginx-custom-error-403-page-configuration/

Seems that I was right in thinking that access to my error page was getting blocked.

Answer 2

The problem might be that you're trying to server a 403 "Forbidden" error from a webserver that they are forbidden from accessing. Nginx treats the error_page directive as an internal redirect. So it is trying to server https://example.com/error403.html which is also forbidden.

So you need to make the error page not served out of https like this:

error_page  403   http://example.com/error403.html

or add the necessary "access allowed" options to the location for the error page path. The way to test this is to access the /error403.html page directly. If you can't accesses that way, it isn't going to work when someone gets an actual 403 error.

Answer 3

I had the same issue... The point is that i've implemented ip whitelist at server context level (or vhost level if you prefer), so every locations will have this as well (basicaly /403.html won't be accessible) :

server {
  listen       *:443 ssl;
  server_name  mydomain.com ;
  error_page 403 /403.html;
  .....
  if ($exclusion = 0) { return 403; } #implemented in another conf.d files (see below)
  location ~ \.php$ {
    root          /var/www/vhosts/mydomain.com/httpdocs;
    include       /etc/nginx/fastcgi_par
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_connect_timeout 3m;
    fastcgi_read_timeout 3m;
    fastcgi_send_timeout 3m;
  }
  location /403.html {
    root      /usr/share/nginx/html;
    allow all;
  }

  ...
}

Exclusion conf.d file sample:

geo $exclusion {
  default 0;
  10.0.0.0/8  Local network
  80.23.120.23 Some_ip
  ...
}

To fix that simply do your return 403 at location level (context):

server {
  listen       *:443 ssl;
  server_name  mydomain.com ;
  error_page 403 /403.html;
  .....
  location ~ \.php$ {
    if ($exclusion = 0) { return 403; } 
    root          /var/www/vhosts/mydomain.com/httpdocs;
    include       /etc/nginx/fastcgi_par
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_connect_timeout 3m;
    fastcgi_read_timeout 3m;
    fastcgi_send_timeout 3m;
  }
  location /403.html {
    root      /usr/share/nginx/html;
    allow all;
  }

  ...
}

Works for me.

Answer 4

It looks like there's a boo-boo in the listed configuration, as it is only sending error code 503 ("service unavailable") to the custom page, so for 403 ("forbidden") you probably want to use:

error_page 403 /error403.html