How to fix 403 in Mac OS X built-in Apache?

I have an alias specified in OSX server pointing to a user directory. I spent a long while chmodding and messing with _www user, adding executable permissions recursively, uninstalling macports and all sorts of stuff trying to get this to work. No idea why it wasn't working.

Eventually, I just checked the "shared folder" checkbox in the Finder for that folder, and it worked, on the specified domain, with php active, the way I wanted it to. :/ ...so that was easy.

I generally fix this by setting the Apache user to myself in local environments and in machines where the only user who uses Apache is me. In /private/etc/apache2/httpd.conf, set User to your username from _www, e.g.:

User _www 

->

User joao 

And then restart Apache:

$ sudo apachectl restart 

Additional steps:

1. If you have active sessions, they are going to give permission errors since they are still owned by _www. Own them:

   $ sudo chown joao: /var/tmp/sess_* 

Implications:

After this, Apache (and PHP et al.) will run as you and will gain read/write permission to all of the files you have read/write permission. But since this is just a local development environment, that shouldn't be a problem unless you have no rules to block Apache in your firewall and let questionable files like file explorers, shells, scripts that may contain vulnerabilities run under Apache; in which case anyone including your public wifi neighbor in a cafe can enter http://<your IP> and do whatever those scripts let them to do.

In fact, you should prevent this regardless of the scripts you run or even if you don't set Apache user to yourself since you probably don't want random outsiders to be able to see the contents of your localhost.

Prevention:

1. Make Apache listen only to localhost. Again, in httpd.conf:

   Listen 80 

   ->

   Listen 127.0.0.1:80 

   And restart Apache again:

   $ sudo apachectl restart 

2. Disable Apache in the application firewall (note that you may have already disabled it if you clicked Deny if/when it was asked during the first time you run Apache):

   1. Open System Preferences » Security & Privacy » Firewall.
   2. Click the lock icon to the lower left and enter your password if needed.
   3. Turn the firewall on if it's disabled.
   4. Click Firewall Options.
   5. Click the + button.
   6. Hit cmd ⌘ + ⇧ shift + G and enter /usr/sbin/httpd and click Add (If httpd doesn't show up there, you can look for it in the terminal by which httpd)
   7. In the list click httpd and select Block incoming connections.
   8. Hit OK.

   9. Reload the firewall:

      $ launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist $ sudo launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist $ launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist $ sudo launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist 

3. Restrict PHP to the document root. In php.ini:

   open_basedir = /Users/joao/Sites/:/var/tmp/ 

   (/var/tmp/ is for sessions)

Use all three solutions to secure yourself in case one of them gets disabled for some reason.

_{- Note that as my active language in my machine is not English right know, wording might be a little different (Menu options and wording can be different regardless of the language in various OS X versions).}

_{- Lines starting with $ need to be entered in command line (Terminal or iTerm etc), with the $ removed.}

I update to macOSS Sierra, Version 10.12

I face the same issue, I did two things to fix it properly. Following is my approaches.

1) Please check "/private/etc/apache2/extra/httpd-userdir.conf" file. Change

#Include /private/etc/apache2/users/*.conf 

to

Include /private/etc/apache2/users/*.conf 

2)**And edit your "/etc/apache2/httpd.conf"

change

Options FollowSymLinks Multiviews 

to

Options FollowSymLinks Multiviews Indexes 

finally your doc root will be look like the following,

DocumentRoot "/Library/WebServer/Documents" <Directory "/Library/WebServer/Documents"> Options FollowSymLinks Multiviews Indexes MultiviewsMatch Any AllowOverride All Require all granted 

3) Restart apache

sudo apachectl restart 

Still you facing the problem, Kindly check How to Set up Apache in macOS Sierra 10.12

The following steps worked for me on High Sierra running Apache 2.4

(Based on the following excellent tutorial: http://www.cgi101.com/book/connect/mac.html, updated with additional steps for version differences)

1. Move the file to:

   /Library/WebServer/CGI-Executables 

2. Verify that the file has execution permissions:

   ls -l /Library/WebServer/CGI-Executables 

   If not use:

   chmod -x /Library/WebServer/CGI-Executables/myfile.cgi 

3. Uncomment the following lines in /etc/apache2/httpd.conf

   AddHandler cgi-script .cgi .pl AddType text/html .shtml AddOutputFilter INCLUDES .shtml LoadModule cgi_module libexec/apache2/mod_cgi.so 

4. Also change the Directory "/Library/WebServer/CGI-Executables" stanza to:

   <Directory "/Library/WebServer/CGI-Executables"> AllowOverride None Options ExecCGI Require all granted </Directory> 

5. Then restart Apache:

   sudo apachectl -k restart 

Almost with every new macOS version, the changes will become lost and you will need to redo the work, and even do different steps to fix it. Your best friend are the Apache logs located in /var/log/apache2/ (/var/log/apache2/error_log)

Step 1: Create a “Sites” directory under /users/USERNAME

Step 2: sudo vi /etc/apache2/httpd.conf

Uncomment the below lines :

LoadModule authz_core_module libexec/apache2/mod_authz_core.so LoadModule authz_host_module libexec/apache2/mod_authz_host.so LoadModule userdir_module libexec/apache2/mod_userdir.so LoadModule include_module libexec/apache2/mod_include.so LoadModule rewrite_module libexec/apache2/mod_rewrite.so Include /private/etc/apache2/extra/httpd-userdir.conf 

Change “User” and “Group” to following :

User USERNAME Group staff 

Step 3: sudo vi /etc/apache2/users/USERNAME.conf

Add the below lines :

<Directory "/Users/USERNAME/Sites/"> AllowOverride All Options Indexes MultiViews FollowSymLinks Require all granted </Directory> 

Step 4: vi /etc/apache2/extra/httpd-userdir.conf

Uncomment the below line :

Include /private/etc/apache2/users/*.conf 

OP describes a problem arising while trying to set up a local web server environment on a Mac, using Apache, PHP, and MySQL, with a custom DocumentRoot, and including a mention of using VirtualHost (vhost). OP reports getting a 403 Forbidden error when accessing localhost.

An article at coolestguidesontheplanet describes how setting up virtual hosts in Apache causes "Losing Localhost". In other words, the root cause of the OP's problem might be an incomplete enabling of vhosts.

"Once [virtual hosts are] set up, you lose your older document root previously at /Library/WebServer/Documents or accessed in the browser at http://localhost -- you get a 403 Forbidden Error."

The article goes on to explain how to fix localhost in a vhost environment.

Add these lines to file /etc/apache2/extra/httpd-vhosts.conf: <VirtualHost *:80> ServerName localhost DocumentRoot /Library/WebServer/Documents/ </VirtualHost> 

It also explains how to fix "permissions issues with things like updates and authentication" associated with "using the Users/username/Sites folder for vhosts".

Instead of using the default UID _www, use your own User and Group. In the terminal, enter command id Find your UID and GID. Update file httpd.conf In section <IfModule unixd_module> Change User and Group to your local UID and GID. 

https://coolestguidesontheplanet.com/set-virtual-hosts-apache-mac-osx-10-10-yosemite/

I am working in a MacOS 10.15.4 environment with a /Sites folder migrated from a much older Mac. I used the instructions from etresoft to set up my server.

Everything followed well until I reached the point "It Works!" In the following step I received the same HTTP Error Code that you do -- namely, 403. This problems was fixed by changing the values of the User and Group directives in the /private/etc/apache2/httpd.conf file from _www to those of my /Sites folder:

User username

Group staff

After making these two very important edits, I made sure that the permissions for all of my folders and files were set to read and write -- namely, 755 and 644 respectively, and applied the sudo apachectl restart command. Setting the permissions for your /Sites folder content can be easily achieved in the GetInfo panel of the /Sites folder. Unlock the panel and look for the gear-icon.

My /Sites folder is now available as a browsable website with PHP functionality. I simply enter localhost/~username/ in my browser window and click return. From there on it is just a matter of setting the proper path to your content.

Well, it worked for me. Maybe it can work for you.

I was using ACL's to set permissions, following the instructions in "How to Set File and Directory Permissions for Apache on Mac OS X", but still getting:

[Wed Feb 12 15:43:51 2014] [error] [client ::1] (13)Permission denied: access to /trace/trace.php denied (filesystem path '/Library/WebServer/Documents/trace/trace.php') because search permissions are missing on a component of the path 

Then I read "(13) Permission Denied" (linked to in João Ramos's answer) and tried adding "execute" to the ACL. That worked.

Restart your computer! This worked for me.

But first of all I had changed the user under apache to myself (from _www), since it is a local/test environment. So ultimately it has something to do with permissions.

Then restart the machine, just like Windows ;).

A simple chmod in a sub-folder of the document root solved the access problem for me in a standard macOS Sites folder setup. Simple issue, simple fix. Maybe the example helps you, too:

1. I followed these instructions to the point to get a Wordpress installation running locally in ~/Sites/wordpress-root/.
2. Access to ~Sites/info.php as created as parts of the instructions under 1 worked.
3. Access to ~/Sites/wordpress-root/ or ~/Sites/wordpress-root/wp-admin/ gave a Forbidden.
4. ~/Sites/wordpress-root/ had privileges 751 set by default (as a tar archive I extracted from the live Wordpress site).
5. I did a chmod 755 ~/Sites/wordpress-root

Things worked.