Oops!! Getting frustrated with Varnish cache server error 403?

Usually, this error occurs due to the caching of error pages, IP rate limiting by backend apps, etc.

Varnish misconfiguration adds additional headaches to server owners.

At Bobcares, we often receive requests to fix such errors as part of our Server Management Services.

Today, let’s check the Varnish 403 error in-depth and see some of its top fixes by our Support Engineers.

What is a varnish cache server error 403?

Before getting much into the error, let’s discuss the Varnish cache in brief.

So, Varnish cache a.k.a caching HTTP reverse proxy is basically a web application accelerator.

It increases the speed of a website while reducing the load on the webserver. Moreover, it is well known for its flexible configuration language, VCL.

Though it has excellent performance, it is never free of errors. And, error 403 is common in varnish and often tricky too.

So, now let’s check how our Support Engineers fix it easily.

How we fix varnish cache server error 403?

We’re all familiar with the error 403, isn’t it?

As we all know, a 403 Forbidden error occurs when a webserver forbids us from accessing the page we’re trying to open in our browser.

But, now let’s check why this error occurs in varnish and how can we fix it easily. This error mainly occurs due to two reasons.

1. Caching of error pages

This is one of the main reasons causing the varnish 403 error.

Mostly, the backend might return 403 only once. But, varnish caches it for future requests.

So, we require varnish to not to cache any error pages. For that, we need to edit the vcl_fetch section.

We call vcl_fetch after a document has been successfully retrieved from the backend. Also, it has a backend response, beresp that contains HTTP headers from the backend.

if (beresp.status >= 400) {
return (hit_for_pass);
}

Adding the above code in the vcl_fetch section resolves the error.

2. Rate limiting per IP

Sometimes, the backend may appear forbidden. Varnish returns this error indicating that the backend is giving 403 errors.

Mostly, this occurs when the backend apps use some sort of rate limiting per IP. When we add varnish to an existing setup, the IP that has been passed to the backend is the varnish is not the source IP.

In such cases, we update the X forwarded by adding the below code to vlc_recv section,

remove req.http.X-Forwarded-For;
set req.http.X-Forwarded-For = client.ip;

This code ensures that the correct client IP has been passed into varnish and prevent itself from throwing 403 error.

[Need more assistance to solve Varnish error? – We’ll help you.]

Conclusion

In short, Varnish cache server error 403 occurs due to caching of error pages, rate limiting per IP by backend apps and so on. Today, we discussed this error in detail and saw how our Support Engineers fix it for our customers.