I came across a subdomain that gives 403 forbidden but opens at the same time. How is this implemented?

Question

Nginx

I came across a subdomain that gives 403 forbidden but opens at the same time. How is this implemented?
When checking a subdomain, 4web gives out 403. At the same time, the subdomain itself opens - in the search for the main domain. Interested for educational purposes.

Answer 1

Why not? technically possible. We send the status code 403, in the body we return the site.

Answer 2

CGI script itself generates all headers. You can write 403 in the headers, and give the contents in the body.
Option No 2: remap the 403 error page to index.html

Answer 3

I will illustrate the answers above with an example in Python (run via CGI).
Here is such a script. Everything before the empty print() is HTTP headers:

#!/usr/bin/env python3

print("Status: 403 Forbidden")
print("Content-type: text/html")
print()
print("<h1>Hello world!</h1>")

If we request a page via curl , then we will get the response body :

$ curl http://example.ru/cgi-bin/scr.py
<h1>Hello world!</h1>

If you request headers, then 403, as indicated in the script:

$ curl -I http://example.ru/cgi-bin/scr.py
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Tue, 17 Nov 2020 12:01:18 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: Accept-Encoding