OAuth Callback 403 Forbidden on Hosted Domain (Works Locally)

[nileshchaudhari]

I’ve implemented Google OAuth2 authentication in my ASP.NET MVC application using the following AuthController. It works perfectly on my local development machine (https://localhost:7085/Auth/Callback), but when I publish the application and host it under my domain, I get the following error after Google account authentication:

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

Here is a summary of my configuration:

private const string ClientId = "xxx";

private const string ClientSecret = "xxx";

private const string RedirectUri = "https://testdomain.in/Auth/Callback";

I have added the correct redirect URI (https://testdomain.in/Auth/Callback) in the Google Cloud Console under OAuth 2.0 Client IDs > Authorized redirect URIs.

The relevant portion of the controller is:

public ActionResult Login()

{

var url = "https://accounts.google.com/o/oauth2/v2/auth?" +

"response_type=code" +

"&client_id=" + HttpUtility.UrlEncode(ClientId) +

"&redirect_uri=" + HttpUtility.UrlEncode(RedirectUri) +

"&scope=" + HttpUtility.UrlEncode(string.Join(" ", Scopes)) +

"&access_type=offline" +

"&prompt=consent";

return Redirect(url);

}

[AllowAnonymous]

public async Task<ActionResult> Callback(string code)

{

// Token exchange and user info retrieval logic

}

What I’ve already checked:

•   The Callback action works perfectly on localhost.

•   The redirect URI is added and verified in the Google Cloud Console.

•   The hosting server supports HTTPS.

•   SSL certificate is valid and accessible.

________________________________________

Questions:

1.  Why does the same controller result in a 403 Forbidden error when hosted?

2.  Could it be related to IIS configuration or domain-level permissions rather than the Google OAuth setup?

3.  Are there any additional headers or response settings required to allow Google to post the auth code to my hosted domain?

Any help or suggestions would be greatly appreciated. Thank you!

[nileshchaudhari · Accepted solution]

After further investigation, I found that the problem was related to my server's ModSecurity rules. Following a reference from Google's support thread here, I discovered that temporarily disabling ModSecurity resolved the issue.

If anyone else encounters a similar problem, checking server-side security rules (like ModSecurity) might be helpful.