HTTP 403 Permission denied after formit submit

Development
1

Using Modx 2.8.3 and formit, I am running a simple contact form which was working fine until now. But since yesterday, without having changed anything inside Modx, I keep getting this error upon form submit:

Title: HTTP 403

Forbidden

You don’t have permission to access this resource.

The Modx error log does not say anything. I cleared the cache, even duplicated all resources to have “fresh” IDs but still get same the error. I checked back with my webhoster if they changed anything on the server side: PHP update, etc. but I haven’t got a response yet. Any ideas what else might be broken?

2

So you can load the resource with the form, but when you submit the form, the permission is denied.
Usually the form submission loads the exact same resource again. Is this also true in this case?

Do you make a redirect after a successful form submission? Is it the redirect resource that can’t be accessed?

3

I was able to track the problem down to this line:

<form action="[[~[[*id]]? &scheme=full]]" method="post">

Once I remove "&scheme=full", it is working. As far as I can remember, it used to work with this parameter before. Since I haven’t changed anything (to my knowldge), I am wondering what might be the reason for it to not work anymore.

4

So what is the rendered URL when you inspect the form in the frontend?
&scheme=`full` should just prepend the URL with the site_url. Is this different than the value in the <base href="..."> tag?

5

Yes, they are different. The base URL gives the full URL https://www.foo.com while the URL inside the form tag shows <form action="subpage#anchor" method="post">. So they must exactly match, right (apart from the anchor appendix to have the site scrolled down after submitting to show a success message)?

6

When you use [[~[[*id]]]] you get a value that is relative to the site URL.
When the <base> tag is https://www.foo.com and [[~[[*id]]]] is subpage#anchor, the form submission calls the URL https://www.foo.com/subpage#anchor.

So in what way is the URL different when you use &scheme=`full` (that gives you an absolute URL) instead?

7

My bad, you are right. But if the URL is not different, what seems to be the problem then?