Suddenly getting 403 FORBIDDEN: 403 Forbidden doing lsf

\\\ https://chartercom.sharepoint.com/sites/FieldEng/ContPM/Shared Documents/Files/ATOM Node Data/2025 MQMS Equip/2025 MQMS Equip Page- 09 Sep/

What is the problem you are having with rclone?

after using rclone successfully for the last few years to pull data off of sharepoint, I am getting a 403 Forbidden when I do the lsf. It worked on Friday and today it is not working. I logged into the website incognito using the username and password and copied the URL from RCLONE configure remote and was able to retrieve the page no problem. Here is the remote config command:

rclone config create mqms webdav url " Sign in to your account Documents/Shared Documents/Forms/AllItems.aspx?id=/sites/FieldEng/ContPM/Files/ATOM Node Data/2025 MQMS Equip/2025 MQMS Equip Page- 09 Sep/" vendor "sharepoint" user pass --non-interactive

The program hasn’t changed since its conception. exact error returned:

rclone lsf --absolute --files-only --max-age 10h --min-age 5m mqms:
2025/09/08 18:18:03 ERROR : : error listing: couldn't list files: 403 FORBIDDEN: 403 Forbidden
2025/09/08 18:18:03 Failed to lsf with 2 errors: last error was: error in ListJSON: couldn't list files: 403 FORBIDDEN: 403 Forbidden

Run the command 'rclone version' and share the full output of the command.

rclone v1.57.0-DEV
  • os/version: redhat 8.10 (64 bit)
  • os/kernel: 4.18.0-553.69.1.el8_10.x86_64 (x86_64)
  • os/type: linux
  • os/arch: amd64
  • go/version: go1.16.12
  • go/linking: dynamic
  • go/tags: none

Which cloud storage system are you using? (eg Google Drive) microsoft sharepoint

The command you were trying to run (eg rclone copy /tmp remote:tmp)

Paste command here

Please run 'rclone config redacted' and share the full output. If you get command not found, please make sure to update rclone.

\\\rclone lsf --absolute --files-only --max-age 10h --min-age 5m mqms:
Paste config here

A log from the command that you were trying to run with the -vv flag

\\\ rclone lsf -vv --absolute --files-only --max-age 10h --min-age 5m mqms:
2025/09/08 18:30:44 DEBUG : --min-age 5m0s to 2025-09-08 18:25:44.712641359 +0000 UTC m=-299.974274888
2025/09/08 18:30:44 DEBUG : --max-age 10h0m0s to 2025-09-08 08:30:44.712695399 +0000 UTC m=-35999.974220837
2025/09/08 18:30:44 DEBUG : rclone: Version "v1.57.0-DEV" starting with parameters ["rclone" "lsf" "-vv" "--absolute" "--files-only" "--max-age" "10h" "--min-age" "5m" "mqms:"]
2025/09/08 18:30:44 DEBUG : Creating backend with remote "mqms:"
2025/09/08 18:30:44 DEBUG : Using config file from "/home/svc-<redacted exact username>/.config/rclone/rclone.conf"
2025/09/08 18:30:44 DEBUG : found headers:
2025/09/08 18:30:46 ERROR : : error listing: couldn't list files: 403 FORBIDDEN: 403 Forbidden
2025/09/08 18:30:46 DEBUG : 6 go routines active
2025/09/08 18:30:46 Failed to lsf with 2 errors: last error was: error in ListJSON: couldn't list files: 403 FORBIDDEN: 403 Forbidden

hi,

https://forum.rclone.org/t/sharepoint-synchronization/52431


that is a ancient, custom compiled, dev version from an out of date repository.

  1. rclone selfupdate
  2. test again

after that, if you need additional help, post the complete output of:
1.rclone version
2.rclone config redacted mqms:
3. your command with -vv

Updated rclone –version results:

dzdo rclone selfupdate
2025/09/08 20:27:52 NOTICE: Successfully updated rclone from version v1.57.0-DEV to version v1.71.0

New version showing correctly:

rclone version
rclone v1.71.0

  • os/version: redhat 8.10 (64 bit)
  • os/kernel: 4.18.0-553.69.1.el8_10.x86_64 (x86_64)
  • os/type: linux
  • os/arch: amd64
  • go/version: go1.25.0
  • go/linking: static
  • go/tags: none

deleted old remote mqms:

rclone config
Current remotes:

Name Type
==== ====
local webdav
mqms webdav
mqmstest webdav
usic webdav

e) Edit existing remote
n) New remote
d) Delete remote
r) Rename remote
c) Copy remote
s) Set configuration password
q) Quit config
e/n/d/r/c/s/q> d

Select remote.
Choose a number from below, or type in an existing value.
1 > local
2 > mqms
3 > mqmstest
4 > usic
remote> 2

results of lsf with -vv:

rclone lsf -vv --absolute --files-only --max-age 10h --min-age 5m mqms:
2025/09/08 20:40:02 DEBUG : rclone: Version "v1.71.0" starting with parameters ["rclone" "lsf" "-vv" "--absolute" "--files-only" "--max-age" "10h" "--min-age" "5m" "mqms:"]
2025/09/08 20:40:02 DEBUG : Creating backend with remote "mqms:"
2025/09/08 20:40:02 DEBUG : Using config file from "/home/svc-prism-foeng-rpt/.config/rclone/rclone.conf"
2025/09/08 20:40:02 DEBUG : found headers:
2025/09/08 20:40:03 ERROR : error listing: couldn't list files: 403 FORBIDDEN: 403 Forbidden
2025/09/08 20:40:03 DEBUG : 8 go routines active
2025/09/08 20:40:03 NOTICE: Failed to lsf with 2 errors: last error was: error in ListJSON: couldn't list files: 403 FORBIDDEN: 403 Forbidden

Not sure if it’s related but OneDrive is currently down for a lot of people.

I can’t confirm that. In the windows world everything works fine for me. I have the same issue as stated by @asdffdsa. My workaround is currently using a windows machine using power shell scripts. This is only a workaround for me I want to have it on a Linux device.

as requested, post the output of rclone config redacted

[mqms]
type = webdav
url = Sign in to your account Documents/Files/ATOM Node Data/2025 MQMS Equip/2025 MQMS Equip Page- 09 Sep/
vendor = sharepoint
user = XXX
pass = XXX

Can you use the OneDrive protocol rather than WebDAV?

I wonder if your admin has disabled access for rclone over WebDAV somehow?

The OneDrive protocol doesn’t play well with my Tenant. It will only find subfolders 2 links deep into my Documents folder. In my case most likely due to the large number of subfolders present.

I guess I could try the OneDrive Protocol, but I would like to find out why after 3 years it suddenly doesn’t work.

I have not seen a response since posting the rclone config redacted. But I have tried to use the copy command vs the lsf. I get a new message with that:

2025/09/12 14:24:06 CRITICAL: Failed to create file system for "mqms:MQMS Equip Page 09_11_2025.xlsx": read metadata failed: 403 FORBIDDEN: 403 Forbidden

And I have also worked with my sharepoint admin. He did verify that Webdav is enabled and that my user has contribute access.

what other webdav clients have you tested?

We were able to access via curl.

Try adding -vv --dump headers to see which request is failing and why. That should help us figure out the problem.

$ rclone lsf --absolute --files-only --max-age 10h --min-age 5m -vv --dump headers remote:
2025/09/15 16:34:40 NOTICE: Automatically setting -vv as --dump is enabled
2025/09/15 16:34:40 DEBUG : --min-age 5m0s to 2025-09-15 16:29:40.807661232 +0000 UTC m=-299.965650240
2025/09/15 16:34:40 DEBUG : --max-age 10h0m0s to 2025-09-15 06:34:40.807682918 +0000 UTC m=-35999.965628563
2025/09/15 16:34:40 DEBUG : rclone: Version "v1.71.0" starting with parameters ["rclone" "lsf" "--absolute" "--files-only" "--max-age" "10h" "--min-age" "5m" "-vv" "--dump" "headers" "remote:"]
2025/09/15 16:34:40 DEBUG : Creating backend with remote "remote:"
2025/09/15 16:34:40 DEBUG : Using config file from "/home/.config/rclone/rclone.conf"
2025/09/15 16:34:40 DEBUG : found headers:
2025/09/15 16:34:40 DEBUG : You have specified to dump information. Please be noted that the Accept-Encoding as shown may not be correct in the request and the response may not show Content-Encoding if the go standard libraries auto gzip encoding was in effect. In this case the body of the request will be gunzipped before showing it.
2025/09/15 16:34:40 DEBUG : You have specified to dump information. Please be noted that the Accept-Encoding as shown may not be correct in the request and the response may not show Content-Encoding if the go standard libraries auto gzip encoding was in effect. In this case the body of the request will be gunzipped before showing it.
2025/09/15 16:34:40 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/09/15 16:34:40 DEBUG : HTTP REQUEST (req 0xc0004fa280)
2025/09/15 16:34:40 DEBUG : POST /extSTS.srf HTTP/1.1
Host: login.microsoftonline.com
User-Agent: rclone/v1.71.0
Content-Length: 1455
Accept-Encoding: gzip

2025/09/15 16:34:40 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/09/15 16:34:41 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/09/15 16:34:41 DEBUG : HTTP RESPONSE (req 0xc0004fa280)
2025/09/15 16:34:41 DEBUG : HTTP/2.0 200 OK
Content-Length: 3707
Cache-Control: no-store, no-cache
Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-fUQmnIsVLd-gWR9sUWgbYA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
Content-Type: application/soap+xml; charset=utf-8
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"
Date: Mon, 15 Sep 2025 16:34:40 GMT
Expires: -1
P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Reporting-Endpoints: coop-endpoint="https://idux.azurewebsites.net/api/coopReport"
Set-Cookie: fpc=AhECnSG-uW1MmWH-5hR19aqwA7reAQAAACA3WuAOAAAA; expires=Wed, 15-Oct-2025 16:34:41 GMT; path=/; secure; HttpOnly; SameSite=None
Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Ms-Ests-Server: 2.1.21894.4 - WUS3 ProdSlices
X-Ms-Request-Id: 7e9af2c7-1421-47f8-827b-d55f14210200
X-Ms-Srs: 1.P
X-Xss-Protection: 0

2025/09/15 16:34:41 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/09/15 16:34:42 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/09/15 16:34:42 DEBUG : HTTP REQUEST (req 0xc000cf2140)
2025/09/15 16:34:42 DEBUG : PROPFIND /sites/FieldEng/ContPM/Shared%20Documents/Files/folder/subfolder/ HTTP/1.1
Host: redacted.sharepoint.com
User-Agent: rclone/v1.71.0
Cookie: =; =
Depth: 1
Referer: https://redacted.sharepoint.com/sites/FieldEng/ContPM/Shared%20Documents/Files/folder/subfolder/
Accept-Encoding: gzip

2025/09/15 16:34:42 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/09/15 16:34:42 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/09/15 16:34:42 DEBUG : HTTP RESPONSE (req 0xc000cf2140)
2025/09/15 16:34:42 DEBUG : HTTP/2.0 403 Forbidden
Content-Length: 13
Content-Type: text/plain; charset=utf-8
Date: Mon, 15 Sep 2025 16:34:42 GMT
Isocdi: 0
Microsoftsharepointteamservices: 16.0.0.26427
Ms-Cv: ocYGdd3wAKBCroVRLIrJoA.0
P3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Request-Id: 7506c6a1-f0dd-a000-42ae-85512c8ac9a0
Splogid: 7506c6a1-f0dd-a000-42ae-85512c8ac9a0
Sprequestguid: 7506c6a1-f0dd-a000-42ae-85512c8ac9a0
X-1dscollectorurl: https://mobile.events.data.microsoft.com/OneCollector/1.0/
X-Ariacollectorurl: https://browser.pipe.aria.microsoft.com/Collector/3.0/
X-Cache: CONFIG_NOCACHE
X-Content-Type-Options: nosniff
X-Databoundary: NONE
X-Forms_based_auth_required: Sign in to your account
X-Forms_based_auth_return_url: Error
X-Idcrl_auth_params_v1: IDCRL Type="BPOSIDCRL", EndPoint="/sites/FieldEng/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"
X-Ms-Invokeapp: 1; RequireReadOnly
X-Msdavext_error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.
X-Msedge-Ref: Ref A: 3E0B51161B1640AB88196123B3F1531E Ref B: DFW311000104027 Ref C: 2025-09-15T16:34:42Z
X-Networkstatistics: 0,4194720,2,169,1157358,1320345,1320345,34115
X-Powered-By: ASP.NET
X-Sharepointhealthscore: 1

2025/09/15 16:34:42 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/09/15 16:34:42 ERROR : error listing: couldn't list files: 403 FORBIDDEN: 403 Forbidden
2025/09/15 16:34:42 DEBUG : 8 go routines active
2025/09/15 16:34:42 NOTICE: Failed to lsf with 2 errors: last error was: error in ListJSON: couldn't list files: 403 FORBIDDEN: 403 Forbidden

It looks like onedrive sharepoint webdav is (going to be?) deprecated. I tried to edit "Permission Level" in "Site permission" and find this line “Use Remote Interfaces - Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site. (Deprecated)“.

A workaround now is to use cookies as suggested in this topic Sharepoint synchronization - #8 by codeye , and wait for the update from either microsoft (maybe not) or rclone (maybe yes):

[NAME_OF_YOUR_REMOTE]
type = webdav
url = YOUR_SHAREPOINT_URL
vendor = other
user = XXX
pass = XXX
headers = Cookie,rtFa=xxx;FedAuth=xxx

To make the cookies workaround automatic, you could use playwright to headless login and get cookies daily.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Created on Wed Sep 17 00:25:09 2025

# For cron jobs:

python3 get_cookis.py rclone_remote_name usr pwd https://<YOURS>.sharepoint.com/<YOURS>/


@author: ttllttttlltt
"""
from playwright.sync_api import sync_playwright
import sys
import time
import configparser

account_name = sys.argv[1]
EMAIL = sys.argv[2]
PASSWORD = sys.argv[3]
SHAREPOINT_URL = sys.argv[4]
rcloneconf = '<PATH_TO_YOUR_rclone.conf>/rclone.conf'


# print('account_name',account_name)
# print('Email:',EMAIL)
# print('pwd:',PASSWORD)

# SHAREPOINT_URL = "https://<YOURS>.sharepoint.com/<YOURS>/"

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True)  # start with headless=False for debugging
    context = browser.new_context()
    page = context.new_page()

    page.goto(SHAREPOINT_URL)

    # Step 1: Enter email/username
    page.wait_for_selector('input[name="loginfmt"]')
    page.fill('input[name="loginfmt"]', EMAIL)
    page.click('input[type="submit"]')

    # Step 2: Enter password
    page.wait_for_selector('input[name="passwd"]')
    page.fill('input[name="passwd"]', PASSWORD)
    page.click('input[type="submit"]')

    try:
        page.wait_for_selector('input[id="idBtn_Back"]', timeout=5000)
        page.click('input[id="idBtn_Back"]')
    except:
        pass

    # Wait until SharePoint page is fully loaded
    # page.wait_for_load_state("networkidle")
    # page.wait_for_selector("div[data-automationid='SiteHeader']", timeout=10000)
    time.sleep(15)
    # Get cookies
    cookies = context.cookies()
    # cookie_header = "; ".join([f"{c['name']}={c['value']}" for c in cookies])
    # rtFa = cookies.get('rtFa')
    for i in cookies:
        if i['name']=='rtFa':
            rtfastr = i['value']
            # print("rtFa:\n", rtfastr)
        if i['name']=='FedAuth':
            fedauthstr = i['value']
            # print("FedAuth:\n", fedauthstr)
            
    # Save session for reuse
    context.storage_state(path="sharepoint_state.json")

    config = configparser.ConfigParser()
    config.sections()
    config.read(rcloneconf)
    
    config[account_name]['headers']='Cookie,rtFa='+rtfastr+';FedAuth='+fedauthstr
    with open(rcloneconf, 'w') as configfile:
        config.write(configfile)
        
    browser.close()

An alternative to WebDAV is being worked on here

Would love to have your thoughts on that

Thanks for your workaround. But after adding headers, I no longer get the errors, but I still don’t get a response from the lsf or copy commands.

Rclone worked really well for me for a long time to access onedrive sharepoint using webdav, until mid year that it stopped working and getting those 403 FORBIDDEN errors. Since then I've only seen a couple of reports about it on this forum, and there's not a straightforward fix to it to be able to use rclone again to access these onedrive remotes, if it is definitely not possible anymore to use rclone in this way you guys gotta update your documentation and clarify that here:

Yes, I agree Thomas. I am still waiting on a solution. I am also trying other solutions (microsoft’s API) but it is really locked down and waiting on a token just to be able to see if it works.

1 Like