internetarchive / internetarchive/openlibrary

Modsecurity: Book Cover 403 Forbidden

Open
#13,286 10 comments 0 reactions 0 assignees View on GitHub
Affects: Server Lead: @jimchamp Module: Modsecurity Needs: Breakdown Needs: Investigation Needs: Response Needs: Staff / Internal Priority: 2 Type: Bug
Dominant language
Python
Stars
6.7k
Forks
2k
Avg merge
2d 19h
Merged PRs (30d)
138

Description

### Problem

As requested by @mekarpeles at https://github.com/internetarchive/openlibrary/issues/12718, I'm creating a new issue. More than once (most recently today), I've gotten a "Book Cover 403 Forbidden" message when I tried to upload book covers from my computer to the following editions:

https://openlibrary.org/books/OL62382445M/Addicted_to_Anxiety
https://openlibrary.org/books/OL33666561M/Ten_Times_Happier

Image

Image

### Reproducing the bug

1. Go to edition [OL62382445M](https://openlibrary.org/books/OL62382445M/Addicted_to_Anxiety) [ISBN 9781250439970] or [OL33666561M](https://openlibrary.org/books/OL33666561M/Ten_Times_Happier) (ISBN 9780008378240);
2. Click "Edit";
3. Click "Add Cover Image";
4. Click "Choose File";
5. Navigate to and select the appropriate cover;
6. Click "Upload."

* Expected behavior: The cover should have been uploaded to the edition.
* Actual behavior: Received a "Book Cover 403: Forbidden" message (see screenshots above).

### Context

- Browser (Chrome, Safari, Firefox, etc): DuckDuckGo and Google Chrome
- OS (Windows, Mac, etc): Windows 11
- Logged in (Y/N): Yes
- Environment (prod, dev, local): prod

### Breakdown

Implementation Details (for maintainers)

#### Requirements Checklist
* [ ]

#### Related files

*

#### Stakeholders

*


#### Instructions for Contributors

- Please [run these commands](https://docs.openlibrary.org/developers/tools/git.html#working-on-your-branch) to ensure your repository is up to date **before** [creating a new branch](https://docs.openlibrary.org/developers/tools/git.html#making-changes-and-creating-a-pull-request) to work on this issue and **each time after** pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the cover upload failure on the two linked editions in production, using the listed browser and Windows context. Trace the upload path and ModSecurity handling for the "Book Cover 403: Forbidden" response; done means valid cover uploads succeed for these editions without the 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.