# Heartbeat HTTP pings fails with 403

**URL:** <https://discuss.elastic.co/t/heartbeat-http-pings-fails-with-403/298289>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [February 25, 2022, 2:11pm UTC](https://discuss.elastic.co/t/heartbeat-http-pings-fails-with-403/298289 "2022-02-25T14:11:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![venkat\_swaminathan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkat_swaminathan/32/85708_2.png) [@venkat\_swaminathan](https://discuss.elastic.co/u/venkat_swaminathan)\
**Post date:** [February 25, 2022, 2:11pm UTC](https://discuss.elastic.co/t/heartbeat-http-pings-fails-with-403/298289/1 "2022-02-25T14:11:28Z")

</div>

Hi Team,

Strange heartbeat is failing with 403 response but we are getting valid 200 responses via CURL & Browser  
. Below is the configuration used for setting up the heartbeat any advice here will be helpful. I have tried setting up headers via heartbeat config too but still no luck.

**Heartbeat Config:**

Trial 1:

```auto
heartbeat.monitors:
- type: http
  schedule: '@every 60s'
  name: "host:Ping"
  urls:
    - https://host.com/xxx/Heartbeat.jsp

```

Trial 2:

```auto
heartbeat.monitors:
- type: http
  schedule: '@every 60s'
  name: Host-2:Ping"
  urls:
    - https://host.com/xxx/Heartbeat.jsp
  ssl:
    supported_protocols: ["TLSv1.3"]
  
  check.request:
    method: GET
    headers:
     - 'Content-Type': 'text/html'
     - 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0'
     - 'Accept-Language':	'en-GB,en;q=0.5'
     - 'Accept-Encoding' : 'gzip, deflate, br'
     - 'set-cookie': 'JSESSIONID=AEE9417DA812869E16222633EA68E582.worker87'
  check.response:
    status: [200]

```

For both configurations, we get **" received status code 403 expecting [200]"**.

 ![Screenshot 2022-02-25 140853](https://us1.discourse-cdn.com/elastic/original/3X/1/3/1300adaa3f0860a0a642cb6deeac71b71414d196.png)

**CURL sample response:**

```auto
heartbeat@756438db75dd:~$ curl -k -v https://HOST
* Trying IP:443...
* TCP_NODELAY set
* Connected to HOST.com (IP) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=*.HOST.com; O=Name Internet Business Solutions Ltd; L=Pieta; C=MT
* start date: Jul 29 11:28:09 2021 GMT
* expire date: Jul 29 11:27:09 2022 GMT
* issuer: C=US; ST=Illinois; L=Chicago; O=Trustwave Holdings, Inc.; CN=Trustwave Organization Validation SHA256 CA, Level 1; emailAddress=ca@trustwave.com
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55e584984e30)
> GET /TDS/Heartbeat.jsp HTTP/2
> Host: HOST.com
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200 
< date: Fri, 25 Feb 2022 13:50:17 GMT
< server: Apache
< strict-transport-security: max-age=31536000; includeSubDomains
< set-cookie: JSESSIONID=4B4FFE3F0C9076F907595B86B273F1D6.worker87; Path=/TDS; Secure; HttpOnly
< content-type: text/html;charset=UTF-8
<

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>
 Component (TDS 1.0.2)
</body>
* Connection #0 to host HOST.com left intact

```

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 28, 2022, 4:32pm UTC](https://discuss.elastic.co/t/heartbeat-http-pings-fails-with-403/298289/2 "2022-02-28T16:32:05Z")

</div>

> [@venkat\_swaminathan](#):
>
> 403

403 corresponds to forbidden. In all likelihood your server thinks heartbeat is a malicious bot and is denying it access. It's not really something we can control on heartbeat since your service is handling things differently.

You could try setting the [user agent header](https://www.elastic.co/guide/en/beats/heartbeat/master/monitor-http-options.html#monitor-http-check) to something else to see if that helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2022, 6:32pm UTC](https://discuss.elastic.co/t/heartbeat-http-pings-fails-with-403/298289/3 "2022-03-28T18:32:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.