# DELETE index fails with 403 Forbidden when request goes through proxy **URL:** \ **Category:** Elasticsearch\ **Created:** [January 21, 2017, 9:15pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376 "2017-01-21T21:15:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)\ **Post date:** [January 21, 2017, 9:15pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/1 "2017-01-21T21:15:57Z")
Hi I have a very strange issue with a newly setup 3-node 5.1.1 cluster (with X-Pack basic installed). Normally I access the ES HTTP port through an Apache reverse proxy. This works fine for most actions, I can use Sense or HQ with no problem. But when I try to DELETE an index, Elasticsearch responds with a 403 Forbidden. I can't find any explanation, not in the response nor in the logs. I can execute the same request with cURL against the localhost Elastic HTTP port, and there the request succeeds. I made sure that it is not the reverse proxy that is blocking the request, I can see the request arriving in Elasticsearch when tracing the localhost traffic behind the proxy. I'm out of options to try, and I totally fail to understand what is going on here. Does anybody have an explanation for this? CU, Joe ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [January 23, 2017, 6:01pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/2 "2017-01-23T18:01:00Z")
Does the user you are trying to delete with have a role assigned that allows them the `delete` permission? ---
**Author:** ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)\ **Post date:** [January 23, 2017, 10:50pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/3 "2017-01-23T22:50:53Z")
As I only have a basic license of X-Pack, the security features are disabled. So I guess user roles are not an issue xpack.security.enabled: false xpack.monitoring.enabled: true xpack.graph.enabled: false xpack.watcher.enabled: false Or did I misunderstand some concept with security here? Also, when issuing the DELETE via localhost directly to Elasticsearch wit cURL (without any authentication), the DELETE works and is acknowledged ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [January 23, 2017, 11:29pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/4 "2017-01-23T23:29:03Z")
Hmm.. if x-pack security is disabled, there should not be any 403 forbiddens sent back from Elasticsearch, does it reproduce every time? This sounds like something that your proxy is doing (though I know you said you tested it without the proxy) ---
**Author:** ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)\ **Post date:** [January 23, 2017, 11:57pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/5 "2017-01-23T23:57:28Z")
Yeah, I was suspecting also my proxy (or CORS) for a long time but what I have checked several times - no apparent limitations (like Limit on DELETE) in the proxy - I can see the HTTP request when watching with wireshark on loopback interface - no obviously wrong headers in the request - the response from Elastic is just a simple 403 Forbidden I just checked again and yes, I can reproduce it. This is my new test installation with 5.1.1. Maybe I have messed up something. I will try another setup and see if I can reproduce it there. At least this surprises you too 🙂 So it's not expected behaviour. ---
**Author:** ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)\ **Post date:** [January 24, 2017, 9:57am UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/6 "2017-01-24T09:57:51Z")
Found it. I setup a second cluster identically to the first, and got the same behaviour. Turns out it was actually a CORS issue. I had http.cors.enabled: true But not http.cors.allow-origin. And it seems that the default for that one has changed from '\*' to "no origins allowed. Adding http.cors.allow-origin: '\*' fixed it. I can do that because I have all the security features I want and need implemented in the reverse proxy. Thanks for your help! Always good to have somebody make me check and recheck again 😉 ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [January 24, 2017, 7:30pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/7 "2017-01-24T19:30:55Z")
Great! Glad you were able to figure it out! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2017, 7:31pm UTC](https://discuss.elastic.co/t/delete-index-fails-with-403-forbidden-when-request-goes-through-proxy/72376/8 "2017-02-21T19:31:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.