Production Rails app hitting infrastructure-level 403 Forbidden on POST requests with raw HTML payloads (Summernote)
azeemh
PROOP

2 months ago

Issue Summary: My Ruby on Rails application deployed on Railway is experiencing intermittent 403 Forbidden errors on state-changing POST requests (such as creating posts or comments).

Technical Details:Server Logs: The Rails logs indicate that the POST requests are completely successful, returning a 302 Found database commit and initiating a redirect.

The Error: Immediately following the redirect, the client browser receives a hard 403 Forbidden response at the network edge (GET requests stall out or drop).

The Trigger: This behavior occurs consistently when the POST payload contains raw HTML strings (generated by the Summernote rich text editor, e.g., , ). Standard, plain-text posts route with no issues. My application has built-in sanitization, but the traffic is being dropped before the application layer can fully complete the handshake cycle.

Question for Support:Is there a Web Application Firewall (WAF), automated XSS filter, or Cloudflare edge rule built into Railway's proxy infrastructure that is flagging raw HTML form parameters? If so, how can I configure or whitelist my custom domain to bypass these automated text-matching rules so my application can accept rich text edits directly?

I am tired of the AI blocking access to my app and users seeing a blank page with "Forbidden" when they already did their 2 factor login and are trying to post html content.

$20 Bounty

6 Replies

Railway
BOT

2 months ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway • 2 months ago

medim
MODERATOR

2 months ago

Hey, this is likely unrelated to Railway, Railway's WAF only handles DDoS/bot protection with browser challenges (see https://docs.railway.com/networking/waf).

Your Rails server logs 302 but the client gets a 403 afterwards, this is happening upstream.

medim

Hey, this is likely unrelated to Railway, Railway's WAF only handles DDoS/bot protection with browser challenges (see https://docs.railway.com/networking/waf). Your Rails server logs 302 but the client gets a 403 afterwards, this is happening upstream.

azeemh
PROOP

2 months ago

well if it's not a WAF then what is it?

EVERY TIME I SEE AI BOT ACTIVITY SPIKE (some microsoft, fastly, google bot or open ai bot SCRAPING MY WEBSITE) THIS KEEPS HAPPENING.

I WANT TO KNOW WHAT DDOS BOT PROTECTION THEY ARE USING BECAUSE IT IS FLAGGING LEGITIMATE RESPONSES and stops all traffic for all users instead of just the IP address of the offending party.

yes i wrote that in all caps. I would have shouted it even louder because that's exactly what i want to investigate instead of you kicking the can/passing the buck.

as a systems engineer i know how vendors work ya'll get tired of users with stupid mistakes so you dismiss everything before you check your own build but railway has had so many failures recently with DNS and setup and i'm sick and tired of y'all bullshitting us and not fixing things.

I'm sure Medim is cool and knows their stuff, but I would appreciate a real person from Railway with diagnostic privileges to actually do a diagnostic and look at the logs.

azeemh
PROOP

2 months ago

Recreation of the issue with more clarity:


{

  "message": "I, [2026-06-24T16:48:10.938320 #1]  INFO -- : [012dabc9-c08c-4e68-876c-714adff19bca] Started GET \"/moments/new\" for 89.222.103.194 at 2026-06-24 16:48:10 +0000",

  "severity": "info",

  "attributes": {

    "level": "info"

  },

  "tags": {

    "project": "2cfdebb0-be71-4807-bc0b-9984236c0b0f",

    "environment": "ec7c1944-a2c9-4b4e-8ab5-308834c5926a",

    "service": "ddfb31a0-73a6-4e68-a716-af827094c49c",

    "deployment": "77df2633-5717-4818-900f-feff97fc1625",

    "replica": "a26e97ce-e5f6-447e-b9de-565f7d6eeba1"

  },

  "timestamp": "2026-06-24T16:48:20.296802598Z"

}

https://railway.com/project/2cfdebb0-be71-4807-bc0b-9984236c0b0f/logs?environmentId=ec7c1944-a2c9-4b4e-8ab5-308834c5926a&timeFrame=30m&permalink=2026-06-24T16%3A48%3A20.296802598Z&start=1782319063803&end=1782319750304

in the logs context


I, [2026-06-24T16:44:40.175215 #1]  INFO -- : [cfbfa072-a8b5-4b34-9fe1-0a74480ef4a8] Started GET "/followidea/479" for 152.233.40.1 at 2026-06-24 16:44:40 +0000

I, [2026-06-24T16:48:10.938320 #1]  INFO -- : [012dabc9-c08c-4e68-876c-714adff19bca] Started GET "/moments/new" for 89.222.103.194 at 2026-06-24 16:48:10 +0000

I, [2026-06-24T16:49:07.828076 #1]  INFO -- : [00e586d7-0d7b-4348-8d95-9760c3fa1a3c] Started GET "/tagged?tag=I+am+because+we+are" for 152.233.23.193 at 2026-06-24 16:49:07 +0000

my request I, [2026-06-24T16:48:10.938320 #1] INFO -- : [012dabc9-c08c-4e68-876c-714adff19bca] Started GET "/moments/new" for 89.222.103.194 at 2026-06-24 16:48:10 +0000 went thru but i only get "Forbidden" as the response.

attached is the screenshot from my iphone of what it looks like.

IMG_7335.png

and after this response the logs don't show any response complete or any error response either. it's just more of the scraper requests and their logs for the other ip addresses:

STARTING WITH OUR 'forbidden' REQUEST


I, [2026-06-24T16:48:10.938320 #1]  INFO -- : [012dabc9-c08c-4e68-876c-714adff19bca] Started GET "/moments/new" for 89.222.103.194 at 2026-06-24 16:48:10 +0000

I, [2026-06-24T16:49:07.828076 #1]  INFO -- : [00e586d7-0d7b-4348-8d95-9760c3fa1a3c] Started GET "/tagged?tag=I+am+because+we+are" for 152.233.23.193 at 2026-06-24 16:49:07 +0000

I, [2026-06-24T16:51:27.331727 #1]  INFO -- : [793e6a06-b436-4918-b728-e6fa88407505] Started GET "/thoughts/10027" for 152.233.47.68 at 2026-06-24 16:51:27 +0000

I, [2026-06-24T16:53:45.104782 #1]  INFO -- : [463ca239-89bf-4066-aea6-a8c187414963] Started GET "/tagged?page%5Bpage%5D=1&tag=dance+music" for 84.17.44.227 at 2026-06-24 16:53:45 +0000

I, [2026-06-24T16:53:46.076312 #1]  INFO -- : [463ca239-89bf-4066-aea6-a8c187414963] Processing by HomeController#tagged as HTML

I, [2026-06-24T16:53:46.076363 #1]  INFO -- : [463ca239-89bf-4066-aea6-a8c187414963]   Parameters: {"page"=>{"page"=>"1"}, "tag"=>"dance music"}

I, [2026-06-24T16:53:47.684297 #1]  INFO -- : [463ca239-89bf-4066-aea6-a8c187414963]   Rendered layout layouts/application.html.erb (Duration: 48.2ms | GC: 0.0ms)

I, [2026-06-24T16:53:47.684573 #1]  INFO -- : [463ca239-89bf-4066-aea6-a8c187414963] Completed 200 OK in 1608ms (Views: 22.9ms | ActiveRecord: 122.7ms (32 queries, 9 cached) | GC: 1303.7ms)

I, [2026-06-24T16:53:55.042226 #1]  INFO -- : [aa73f06f-4692-4027-b108-8f6a8e2475e0] Started GET "/moments/250" for 152.233.30.101 at 2026-06-24 16:53:55 +0000

I, [2026-06-24T16:53:55.730263 #1]  INFO -- : [aa73f06f-4692-4027-b108-8f6a8e2475e0] Processing by MomentsController#show as HTML

I, [2026-06-24T16:53:55.730304 #1]  INFO -- : [aa73f06f-4692-4027-b108-8f6a8e2475e0]   Parameters: {"id"=>"250"}

I, [2026-06-24T16:53:55.800547 #1]  INFO -- : [aa73f06f-4692-4027-b108-8f6a8e2475e0]   Rendered layout layouts/application.html.erb (Duration: 50.8ms | GC: 0.0ms)

I, [2026-06-24T16:53:55.800822 #1]  INFO -- : [aa73f06f-4692-4027-b108-8f6a8e2475e0] Completed 200 OK in 70ms (Views: 23.6ms | ActiveRecord: 34.5ms (11 queries, 0 cached) | GC: 0.0ms)

I, [2026-06-24T16:56:10.114636 #1]  INFO -- : [1e619e86-67d2-45ac-92bc-937f9819b889] Started GET "/ideas/rip-maxi-jazz" for 152.233.40.2 at 2026-06-24 16:56:10 +0000

I, [2026-06-24T16:56:11.094634 #1]  INFO -- : [1e619e86-67d2-45ac-92bc-937f9819b889] Processing by IdeasController#show as */*

I, [2026-06-24T16:56:11.094674 #1]  INFO -- : [1e619e86-67d2-45ac-92bc-937f9819b889]   Parameters: {"id"=>"rip-maxi-jazz"}

I, [2026-06-24T16:56:11.148091 #1]  INFO -- : [1e619e86-67d2-45ac-92bc-937f9819b889]   Rendered layout layouts/application.html.erb (Duration: 33.8ms | GC: 0.0ms)

I, [2026-06-24T16:56:11.148396 #1]  INFO -- : [1e619e86-67d2-45ac-92bc-937f9819b889] Completed 200 OK in 54ms (Views: 13.1ms | ActiveRecord: 32.0ms (12 queries, 1 cached) | GC: 0.0ms)

Attachments

IMG_7335.png
azeemh
PROOP

2 months ago

bump

azeemh
PROOP

2 months ago

even logging in to my app with a private tab on iphone doesn't work and it shows the same thing: forbidden. ON THE LOGIN SCREEN/root route.

azeemh
PROOP

2 months ago

Today this morning i get the same thing even on my root login page. there isn't even rack attack or any middle ware on that route so we definitively know there isn't any reason why my I, [2026-06-28T13:02:42.478358 #1] INFO -- : [a2db3f91-9af6-435b-8c96-789e1eac5817] Started GET "/" for 89.222.103.193 at 2026-06-28 13:02:42 +0000 never rendered or gave a response.


I, [2026-06-28T13:02:16.219045 #1]  INFO -- : [815805b6-735f-45bb-9c74-f40fbb3d985f] Started POST "/users/sign_in" for 89.222.103.193 at 2026-06-28 13:02:16 +0000

I, [2026-06-28T13:02:42.478358 #1]  INFO -- : [a2db3f91-9af6-435b-8c96-789e1eac5817] Started GET "/" for 89.222.103.193 at 2026-06-28 13:02:42 +0000

I, [2026-06-28T13:03:21.617989 #1]  INFO -- : [3d2776aa-7af2-4d38-861b-9d7a1320a04c] Started GET "/moments/171" for 152.233.23.193 at 2026-06-28 13:03:21 +0000

I, [2026-06-28T13:03:22.740434 #1]  INFO -- : [3d2776aa-7af2-4d38-861b-9d7a1320a04c] Processing by MomentsController#show as */*

I, [2026-06-28T13:03:22.740477 #1]  INFO -- : [3d2776aa-7af2-4d38-861b-9d7a1320a04c]   Parameters: {"id"=>"171"}

I, [2026-06-28T13:03:22.792556 #1]  INFO -- : [3d2776aa-7af2-4d38-861b-9d7a1320a04c]   Rendered layout layouts/application.html.erb (Duration: 39.6ms | GC: 0.3ms)

I, [2026-06-28T13:03:22.792792 #1]  INFO -- : [3d2776aa-7af2-4d38-861b-9d7a1320a04c] Completed 200 OK in 52ms (Views: 17.6ms | ActiveRecord: 27.4ms (11 queries, 0 cached) | GC: 0.3ms)

see screenshot video in vlc player etc

Attachments

ScreenRecor...

Welcome!

Sign in to your Railway account to join the conversation.

Login
Loading...