How long from re-enabling an application does it become available?

[mark4]

I disabled my GAE app for a few hours and then re-enabled it. According to the log and the dashboard summary graph it is now serving. Also ping works (and didn't when it was disabled). But when I try to access the site in Firefox I get a 403 (Forbidden) error. I have cleared the Firefox cache and still get a 403.

Did I need to do something more than just click Enable? (But if so, why is it serving, but not to me?) Or could it be some kind of deployment latency that will resolve in time?

[NoCommandLine]

403 means forbidden i.e. you're not authorized. Your site is up but it's saying you're not allowed to access that page.

Did you mistakenly set login:admin in your app.yaml (see doc) and you're signed in to Google (in same browser) using an account that isn't the admin?

Or did you turn on IAP and didn't include your current signed-in account?

What do you see in the logs on Google Cloud console?

.. NoCommandLine ......

 https://nocommandline.com

A GUI for Google App Engine
    & Datastore Emulator

[mark4]

The only thing I did was click the disable application button, and then a few hours later click the enable button that had taken its place. I did no other changes.

My app.yaml doesn't have a login entry.

It begins:

runtime: python310

automatic_scaling:
max_instances: 2
min_idle_instances: automatic
max_idle_instances: 1
max_concurrent_requests: 10

handlers:

....

As for IAP I did no changes but when I visit the IAM page and click View Recommendations in Table, it lists a service a/c xxxxx@cloudservices.gserviceaccount.com with the Grant Access link enabled. But when I click that link and choose that service it then asks what roles to give it, but I don't know which ones so I just canceled and left it unchanged.

In the Logs Explorer it shows a lot of GET 200 entries and some "boot worker" entries. Surely the 200s mean that other people can see my site, even if I can't?

Also, my wife (on the same computer as me) logged in and tried to access my site and also got a 403. Could it simply be down to latency - the server in the US and us in Europe?

Although that doesn't explain why ping works. Although I've now noted that when I ping my website the site that actually gets pinged is ghs.googlehosted.com. So could it be that disabling "knocked out" my DNS record and that enabling will take time for the DNS to be updated?

[NoCommandLine]

> In the Logs Explorer it shows a lot of GET 200 entries....Surely the 200s mean that other people can see my site
It depends on what the 200 entries are for. Are they for the same resources/pages you're getting 403 for?

- The login entry will be under handlers (for one of your routes) in your app.yaml file. 

- Does your response mean you have IAP turned on but you're saying you didn't make any changes after you disabled and re-enabled your App?

..... NoCommandLine ......

 https://nocommandline.com

A GUI for Google App Engine
    & Datastore Emulator

[mark4]

I have some 200s and 204s for a page called 'biblio.html', including some for a friend in another country I asked to visit my site & who found it works fine. But when I visit that page myself I get a 403 (but no 403s or other errors are in the log).

The word 'login' does not appear in my app.yaml file.

I don't know whether IAP is turned on (or even what it is). I really did only disable and then enable the app without changing anything else.

I just did an update (changed 4 .html pages and changed app.yaml's max_instances to 1) and gcloud app deploy ... worked fine. Well it didn't give any errors, the log still shows that other people are getting 200s; but I'm still getting 403s.

[NoCommandLine]

Can you post the full log for the 403 response?

..... NoCommandLine ......

 https://nocommandline.com

A GUI for Google App Engine
    & Datastore Emulator

[mark4]

As I mentioned before: there are no 403 log entries.

I went to the logs and did a fresh query; then I went to my website and tried the home page and some other pages, all of which gave 403 Forbidden responses. Then I went back to the logs and reran the query several times until I saw both the entries I'd seen before I got the 403s and new ones afterward. And in between there were no 403s at all. Before was a 200 followed by many 204s, then, some 200s and 304s interspersed: but no 403s or any other errors at all. (The query is the "empty" query, i.e., everything up to this moment.)

I did add a new security certificate last Thu or Fri & when I try to visit my site in a VM (not as me) it gives me a security warning (and then 403 Forbidden). GAE checked the certificate & I got it from gandi.net like always & the site worked fine after I put it in GAE, i.e., before I did the disable app. Anyway, I've now switched back to the "old" SSL cert & will use it until the day before it expires (end of this month) & then use the new one. Hasn't changed the 403s I'm getting but presumably the change will take some time. (And this assumes the cert is the problem, which I doubt.)

[mark4]

I no longer have this problem.