Http 406 error on javascript ajax post. Accept header set to accept all

Question

I am getting an error from the server when I try to make an AJAX request that I cannot figure out. It is an HTTP 406 error. From what I understand this means that the server cannot send a response in the format that the Accept header indicates. But from what I can see, I am Accepting */* (wildcard).

You can see the details of my HTTP request in this image. https://i.sstatic.net/fTfBf.png

This is my PHP code for the page:




             (snip - menu and header)

    
        
            Saved!
        
    
    
        
        
    
    
    
    

        
            

    
        
        
            

            

        
        <script src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

Javascript:

// Attach a submit handler to the form
$( "#update-button" ).click( function( event ) {
    // Stop form from submitting normally
    event.preventDefault();

    // Get some values from elements on the page:
    var $form = $('#template-form');
    var template_id = $form.find( "input[name='id']" ).val();
    var template_name = $form.find( "input[name='name']" ).val();
    var template_value = $form.find( "textarea[name='value']" ).val();

    var template_is_major = 'minor';
    if( $( "input[name='major']" ).prop('checked') ){
        template_is_major = "major";
    }

    var url = $form.attr( "action" );

    // Send the data using post
    var posting = $.post( url, {  id: template_id, name: template_name, value: template_value, major: template_is_major, action: "Update Template"  } );

    // Show that the request has completed successfully
    posting.done(function( data ) {
        $('#notify-saved').slideDown(200).delay(500).slideUp(500);
    });
});

.

Also of relevance is the fact that this error only happens some of the time, for instance if the template-value submitted is

<script src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

then there will be an error, but if the leading < is omitted, then there is no error:

script src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

The receiving php looks like this (post-actions.php):

 $v) {
                unset($process[$key][$k]);
                if (is_array($v)) {
                    $process[$key][stripslashes($k)] = $v;
                    $process[] = &$process[$key][stripslashes($k)];
                } else {
                    $process[$key][stripslashes($k)] = stripslashes($v);
                }
            }
        }
        unset($process);
    }


    require_once('database.php');
    $dbo = new Database();

    if( isset( $_REQUEST['action'] ) ){

        switch( $_REQUEST['action'] ){

            (snip - many irrelevant cases)

            case "Update Template":
                $dbo->UpdateTemplate( $_REQUEST[DB_TEMPLATES_ID], $_REQUEST[DB_TEMPLATES_NAME],
                $_REQUEST[DB_TEMPLATES_VALUE], $_REQUEST[DB_TEMPLATES_MAJOR] );
                break;



        }

    }

And the database class:

db = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
        if($this->db->connect_errno > 0){
            die('Unable to connect to database [' . $this->db->connect_error . ']');
        }

        $this->pdo = new PDO('mysql:host='.DB_HOST.';dbname='.DB_NAME.';charset=utf8', DB_USER, DB_PASS );
        $this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $this->pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
    }

    function __destruct(){
        $this->db->close();
        $this->pdo = null;
    }


        $query = 'INSERT INTO `'.DB_TEMPLATES.'` ( `'.DB_TEMPLATES_NAME.'` ) VALUES ( :name )';

        $stmt = $this->pdo->prepare($query);
        $stmt->bindValue(":name", $name, PDO::PARAM_INT);
        $stmt->execute();

    }

    function updateTemplate($id, $name, $value, $major ){

        if( $major == "major" ){ $major = 1; }
        else{ $major = 0; }

        $query = 'UPDATE `'.DB_TEMPLATES.'` 
                    SET 
                    `'.DB_TEMPLATES_NAME.'`=:name,
                    `'.DB_TEMPLATES_VALUE.'`=:value,
                    `'.DB_TEMPLATES_MAJOR.'`=:major
                    WHERE
                    `'.DB_TEMPLATES_ID.'`=:id';

        $stmt = $this->pdo->prepare($query);
        $stmt->bindValue(":name", $name, PDO::PARAM_STR );
        $stmt->bindValue(":value", $value, PDO::PARAM_STR );
        $stmt->bindValue(":major", $major, PDO::PARAM_INT );
        $stmt->bindValue(":id", $id, PDO::PARAM_INT );

        $stmt->execute();

    }


        $query = '  DELETE FROM '.DB_TEMPLATES.'
                    WHERE
                    '.DB_TEMPLATES_ID.'=:id';

        $stmt = $this->pdo->prepare($query);
        $stmt->bindValue(":id", $id, PDO::PARAM_INT);

        $stmt->execute();


    }

    (snip - irrelevant functions)

}

At certain points along the way, I had thought this may have been a character encoding issue, but I don't think that any more. Perhaps it is some odd character escaping issue? Other posts here on SO seem to indicate it is a configuration issue / (feature?) of apache's mod_security. I tried disabling a few different things but that did not work, and now I am just at a loss as for what to think.

Thanks for your help.

regilero · Accepted Answer

The fact that you have a 406, and also the fact that this is based on the presence of the < before the word script, leads directly to a security filter in action. So mod_security and apache configuration files would be more useful than the js/php code to find the root blocking rule.

This looks like an anti-xss filter. Maybe a very simple one like:

SecFilter "<( |
)*script"

If you can alter this mod_security configuration, then do that... or don't. It's about security. Maybe you should keep theses filter in place to protect your application for really unwanted script injections. Maybe the real solution is that your official application forms should manage communications with the server without being suspicious for mod_security. And here your POST is too much like a Cross Site Scripting attack for a tool which is only reading the stream and detect a javascript call inside.

You could for example add a base64 encoding on the POSTed value (from the js) and decode the result on the PHP side, some base64 encoding js libraries are available on github.

You could in fact apply any transformation on your data that render this data HTML-free (and Javascript-free), at least for the HTTP filtering tools. And Base64 is usually the solution, but check how the used library manage encoding of utf-8 characters, the real base64 was ascii only.

Http 406 error on javascript ajax post. Accept header set to accept all

Answers (2)

Related Questions