Why does Membrane API Gateway return 403 Access Denied?

The accessControl plugin did not permit the client's address. Either a deny rule matched first, or no rule matched, in which case access is denied by default.

Why is my client denied although its address is allowed?

Membrane checks the TCP peer address of the connection, not X-Forwarded-For. Behind a load balancer or reverse proxy, the rules see the address of the proxy.

Does production mode hide the details of Access Denied errors?

No. The accessControl plugin always sends the link to the documentation, even when Membrane runs in production mode.

403 Forbidden: Access Denied

Membrane API Gateway returns 403 Forbidden with the title Access Denied when the accessControl plugin does not permit the client's address. This is the configured policy acting on the client, not a malfunction of the gateway.

The Error Response

The response contains the status 403 Forbidden, the title Access Denied, the problem type https://membrane-api.io/problems/security and a link to this page. The type security means that a security plugin refused access to the API.

How Access Control Works

The accessControl plugin evaluates an ordered list of allow and deny rules in the request flow. A rule contains an IPv4 or IPv6 address, optionally with a CIDR prefix, or a hostname pattern. The first rule that matches decides. If no rule matches, access is denied.

api:
  port: 2000
  flow:
    - accessControl:
        - allow: "10.0.0.0/8"
        - deny: "0.0.0.0/0"
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - accessControl:
        - allow: "10.0.0.0/8"
        - deny: "0.0.0.0/0"
  target:
    url: https://api.predic8.de

Common Causes

A Deny Rule Matches First

The first matching rule is a deny rule for the client's address or hostname. An allow rule further down the list is never reached.

No Rule Matches

When none of the rules matches the client's address, access is denied by default.

Membrane Sees the Address of a Proxy

The plugin checks the TCP peer of the connection, not the X-Forwarded-For header. Behind a load balancer or reverse proxy, the rules see the proxy's address instead of the client's.

A Hostname Rule Does Not Match

Hostname rules are matched against the reverse DNS name of the peer. If that name differs from the pattern, for example because reverse DNS is not set up, the rule does not match.

The Client Address Cannot Be Determined

If the client address cannot be determined or parsed, the request is always denied.

How to Fix It

Look for the log line Access denied from ... at info level. It shows the address that was checked.
Add an allow rule for the address, CIDR range or hostname, and place it before any broader deny rule.
If Membrane runs behind a proxy, write the rules for the proxy's addresses, or enforce access control on the proxy.
Client: connect from an address that the API owner allows.

Details in Production Mode

Unlike most errors, this error is sent with the link to this page even when Membrane runs in production mode. Setting production: true in the configuration document does not remove it.