{"record":{"id":"8426592cc2270e74","repo":"gollum/gollum","slug":"accessing-this-resource-is-not-allowed","errorCode":null,"errorMessage":"Accessing this resource is not allowed.","messagePattern":"Accessing this resource is not allowed\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"lib/gollum/app.rb","lineNumber":606,"sourceCode":"      path      = wikip.path\n      if page = wikip.page\n        @page    = page\n        @name    = name\n        @content = page.formatted_data\n        @version = version\n        @historical = true\n        @bar_side = wikip.wiki.bar_side\n        @navbar   = true\n        mustache :page\n      elsif file = wikip.wiki.file(file_path, version, true)\n        show_file(file)\n      else\n        halt 404\n      end\n    end\n\n    get '/\\.redirects\\.gollum' do\n      forbid('Accessing this resource is not allowed.')\n    end\n\n    get '/*' do\n      fullpath = params[:splat].first\n      if params.has_key?(\"raw\")\n        show_raw_page(fullpath)\n      else\n        show_page_or_file(fullpath)\n      end\n    end\n\n    private\n\n    def redirect_to(redirect_path, fullpath, query_params)\n        redirect to(\"#{encodeURI(redirect_path)}?redirected_from=#{encodeURI(fullpath)}#{query_params}\")\n    end\n\n    def page_does_not_exist()","sourceCodeStart":588,"sourceCodeEnd":624,"githubUrl":"https://github.com/gollum/gollum/blob/d00fefc89be0ab22ab862a51299120a55ccd9280/lib/gollum/app.rb#L588-L624","documentation":"Gollum stores page-rename redirects in the repo-root file .redirects.gollum and deliberately refuses web reads of it: GET /.redirects.gollum is matched by a dedicated route that halts 403 'Accessing this resource is not allowed.', ahead of the catch-all get '/*'. This keeps clients from enumerating the redirect rules.","triggerScenarios":"Requesting GET /.redirects.gollum directly in a browser, or crawlers/scanners following repo file listings probing for dotfiles.","commonSituations":"Users curious how gollum redirects work after renaming pages; security scans flagging then fetching the dotfile; scripts assuming every repo file is web-readable.","solutions":["Read the file via git: git show HEAD:.redirects.gollum in a clone","Edit redirect rules only via git commit, never through HTTP","Expect 403 for this URL in monitoring/health checks - it is by design, not a misconfiguration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# /\\.redirects\\.gollum is always 403 over HTTP - read it via git instead:\n# git show HEAD:.redirects.gollum","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never fetch dotfiles over gollum's HTTP surface; use git for reads and writes","Exclude /.redirects.gollum from crawlers and health checks"],"tags":["gollum","http-403","redirects","protected-resource"],"backgroundTag":"http-403-forbidden","analyzedSha":"d00fefc89be0ab22ab862a51299120a55ccd9280","analyzedAt":"2026-08-21T15:14:18.608Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}