# 403 Forbidden when accessing permalinks without login **URL:** \ **Category:** Site Feedback\ **Created:** [August 4, 2026, 5:13pm UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140 "2026-08-04T17:13:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![robink](https://forum.codefloe.com/user_avatar/forum.codefloe.com/robink/32/211_2.png) [@robink](https://forum.codefloe.com/u/robink)\ **Post date:** [August 4, 2026, 5:13pm UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/1 "2026-08-04T17:13:57Z")
I tried to share a permalink like [https://codefloe.com/robink/ctaphid-rs/src/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0/Cargo.toml#L8](https://codefloe.com/robink/ctaphid-rs/src/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0/Cargo.toml#L8) but noticed that it returns 403 Forbidden if the visitor is not logged in. Is this behavior intentional? Maybe it is related to rate limiting but it also occurs without previous requests to [codefloe.com](http://codefloe.com). ---
**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/347_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\ **Post date:** [August 4, 2026, 8:28pm UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/2 "2026-08-04T20:28:44Z")
> [@robink](#): > > [https://codefloe.com/robink/ctaphid-rs/src/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0/Cargo.toml#L8](https://codefloe.com/robink/ctaphid-rs/src/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0/Cargo.toml#L8) Yes, that is blocked currently by our current HAProxy rules to gate automated scraping. We’ve just updated the 403 error page with some useful information. In your case, the following patterns would work without a session token: - `/owner/repo/commit/HASH` shows the same commit as a diff → [https://codefloe.com/robink/ctaphid-rs/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0](https://codefloe.com/robink/ctaphid-rs/commit/0d078c1b4b8184b98c1d05964e21bd1c9e824ad0) - `/owner/repo/src/branch/main/path/to/file` shows the current file on a branch → [https://codefloe.com/robink/ctaphid-rs/src/branch/main/Cargo.toml](https://codefloe.com/robink/ctaphid-rs/src/branch/main/Cargo.toml) We are aware this is not super great for users but we have to do this for a reason, otherwise we get overrun by automated bots. Would the above workarounds work for you? ---
**Author:** ![robink](https://forum.codefloe.com/user_avatar/forum.codefloe.com/robink/32/211_2.png) [@robink](https://forum.codefloe.com/u/robink)\ **Post date:** [August 4, 2026, 9:08pm UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/3 "2026-08-04T21:08:27Z")
Thanks for the explanation! I’m very used to permalinks when referencing a specific code location and the mentioned workarounds unfortunately don’t really work for that. The commit does not necessarily include the relevant lines, and the file on the current branch may have changed when the link is accessed. But of course I understand that you have to make some restrictions. Still I think it would be good to show a warning when using the „Copy permalink“ option in the file view as long as this restriction is in place. Most likely the link will be stored or sent somewhere and not used directly and it is very unexpected if it does not work. ---
**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/347_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\ **Post date:** [August 5, 2026, 6:19am UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/4 "2026-08-05T06:19:21Z")
Permalinks are an important feature, we are aware of that. We’d like to bring it back - we just need to find a good pattern to prevent the abusive scraping requests and allow “normal” users. The tricky part is that these requests are spread across many (we’re talking about 1000+) servers and the overall count per IP is low (and sometimes even just one) for unique IPs. So the scrapers are actively trying to get around rate limiting here. Besides the scraping, such hash commits are super expensive on the Git side, i.e. they take substantially more resources for the lookup than non-hash URLs. We’ll let you know once we have found a better solution! ---
**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/347_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\ **Post date:** [August 6, 2026, 7:53am UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/5 "2026-08-06T07:53:01Z")
We have now implemented changes that generally allow permalinks again and send a little challenge for these paths which, hopefully, automated processed won’t be able or don’t want to solve. These shouldn’t be a problem for normal users though. It’s a similar attempt as what Anubis is doing, just more lightweight. Let us know how it goes for you and if you encounter any additional issues whatsoever! Thanks for reaching out again! ---
**Author:** ![robink](https://forum.codefloe.com/user_avatar/forum.codefloe.com/robink/32/211_2.png) [@robink](https://forum.codefloe.com/u/robink)\ **Post date:** [August 6, 2026, 9:46am UTC](https://forum.codefloe.com/t/403-forbidden-when-accessing-permalinks-without-login/140/6 "2026-08-06T09:46:04Z")
Great news! That works for me.