Here is the relevant snippet from nginx which at the moment returns a 403 error.

   location /specialoutput/ {
      limit_req zone=mylimit burst=20 nodelay;
      root /data/customUser/outputFiles/customApp/csv/;
      index index.html index.htm
      autoindex on;

Now, the csv subfolder has the following permissions:

drwxr-xr-x 12 customUser customUser  289 Apr  9 19:17 csv

Why am I still getting a 403 Forbidden error? Any way around this?


1 Answer 1


http error 403 means :

The HTTP server understood the request, but is refusing to fulfill it.
This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable (for example the server is an Intranet and only the LAN machines are authorized to connect).

I don't know ngix but I would check if the parents directories also give at least read and crawl rights to the ngix request server process (customUser I presume) into sub directories.

The files into the CSV directory must be readable by that same nginx process.

  • Right, but is there a way that I don't open up all the parent directories above that? Or just open it up to a specific nginx user? If I chmod 755 then any user can go anywhere above that which is no good. Apr 9, 2019 at 22:07
  • Well, 755 rights for a directory do not give write access into it. x access right for a directory give the right to crawl into it. So I think you may leave the directories as 755 and just give 640 or 660 access to the files into the CVS's directory to your ngix user and its group. Others don't have anything to do here and cannot even read what is in. For yourself, in case of update or maintenance, you may be part of the ngix group.
    – PhLinuX
    Apr 11, 2019 at 7:25
  • For instance: # 755 if you want anyone able to *only* read what is in cvs_dir # 750 no one but ngix can go and read what is in cvs_dir chmod 750 -R /path_to_cvs/cvs_dir # All into cvs_dir is ngix owned chown -R ngix_usr:ngix_grp /path_to_cvs/cvs_dir # Only ngix_usr and its group members can read the files into cvs_dir # use 660 if you want to also have write access ad members of ngix_grp find /path_to_cvs/cvs_dir -type f -exec chmod 640 {} \; # If, for maintenance reasons, add yourself into ngix_grp # case where cvs_dir is setted to 660 group add myself ngix_grp
    – PhLinuX
    Apr 11, 2019 at 7:26
  • Myself, with apache, only apache can read/write files. For maintenance, I use sudo Please, before any modification, write down current UGO rights access you are going to change in order to be able to get back if something goes wrong. (a tar file of the whole directory for example does the trick)
    – PhLinuX
    Apr 11, 2019 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .