title: ElasticSearch: Host Responding with 403 Error for a Single Website
body: <p>We have a production box with several sites running on it, all of them using ElasticSearch.
  All the sites have an http and https binding with a host, <code>www.&lt;sitename&gt;.co.za</code>, with their own ElasticSearch index, <code>&lt;sitename&gt;_index</code>. The ElasticSearch is setup as an application, <code>/ESP</code>, under the website and has a rewrite URL that directs it to the actual ElasticSearch on the machine.</p>
  
  <p>I have added a new website with the same setup as the others, with http and https bindings with a host.
  The site is running and seems to attach to the ElasticSearch correctly in the beginning. But when I try to actually search using the ElasticSearch, it gives me a 403 error.</p>
  
  <p><a href="https://i.stack.imgur.com/LlmBO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LlmBO.png" alt="enter image description here"></a>
  <a href="https://i.stack.imgur.com/I3zax.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/I3zax.png" alt="enter image description here"></a>
  The thing is, if I change the bindings to not have a host and only go by IP and port, the ElasticSearch works, and if I take the full URL request that fails from within the site and attempt it through Postman or even just in the browser directly, it works and returns data as expected.</p>
  
  <p><strong>EDIT 1:</strong></p>
  
  <p>I was asked for the rewrite rules for the <code>ESP</code> application. It is the same for the websites that work and the one that doesn't. The blacked out bit is the server IP.
  <a href="https://i.stack.imgur.com/yMz5E.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yMz5E.png" alt="enter image description here"></a></p>
  
  <p><strong>EDIT 2:</strong></p>
  
  <p>I have set an existing, correctly setup website to use the new domain and the ElasticSearch still fails with the 403, with everything else still setup as it was.</p>
  
  <p>The only differences in the passing and failing header is the authority, origin and referer.</p>
  
  <p><strong>EDIT 3:</strong></p>
  
  <p>I found the following under the <code>LogFiles</code> for the website. I don't know if this will be of any use.</p>
  
  <pre><code>2018-10-30 06:47:14 &lt;IP&gt; POST /ESP/&lt;sitename&gt;_index/_search size=20&amp;X-ARR-CACHE-HIT=0&amp;X-ARR-LOG-ID=d742707c-b48d-41a9-9b78-401822fe24e4&amp;SERVER-STATUS=403 443 - 169.0.227.54 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/70.0.3538.77+Safari/537.36 https://www.&lt;domain&gt;.co.za/ 403 0 0 273
  2018-10-30 06:47:14 &lt;IP&gt; HEAD /ESP/ _=1540881129027&amp;X-ARR-CACHE-HIT=0&amp;X-ARR-LOG-ID=532ffa02-b818-4e4f-bbbf-604f76fff4d4&amp;SERVER-STATUS=400 443 - 169.0.227.54 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/70.0.3538.77+Safari/537.36 https://www.&lt;domain&gt;.co.za/ 400 0 0 82
  </code></pre>