Got 404 on login attempt (Template not found: actions/users/login)

Question

Can't login in my staging env since last full plugins/craft update (still able to in my local env).

I already...

1. Remove my composer.lock and /vendor files and re-install all components
2. Rename/delete the /web/cpresources directory
3. Flush all caches throught CLI command
4. Try to login in Private mode and other browsers

And still, I got this as a response :

{"error":"Template not found: 403.shtml"}

Here's the trace

https://pastebin.com/63NA1XQy

Here's the composer.json

{
    "require": {
        "craftcms/cms": "3.1.31",
        "vlucas/phpdotenv": "^2.4.0",
        "spicyweb/craft-neo": "2.3.5",
        "anubarak/craft-relabel": "1.3.1",
        "ether/seo": "3.5.4",
        "verbb/super-table": "2.1.20",
        "verbb/expanded-singles": "1.0.7",
        "verbb/field-manager": "2.1.0",
        "craftcms/redactor": "2.3.3.2",
        "verbb/navigation": "1.1.12",
        "pennebaker/craft-architect": "2.3.1",
        "marionnewlevant/twig-perversion": "2.1.0",
        "clubstudioltd/craft-inline-svg": "v0.1.1",
        "marionnewlevant/snitch": "3.0.0",
        "selvinortiz/patrol": "3.1.3",
        "fruitstudios/linkit": "1.1.11",
        "craftcms/contact-form": "2.2.5",
        "tomodomo/twig-pluralize-extension": "^2.0",
        "verbb/icon-picker": "^1.0",
        "craftcms/element-api": "^2.5"
    },
    "config": {
        "optimize-autoloader": true,
        "platform": {
            "php": "7.2.10"
        }
    },
    "autoload": {
        "psr-4": {
            "modules\\businesslogic\\": "modules/businesslogic/src/"
        }
      },
    "scripts": {
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ]
    }
}

–

EDIT: Apparently this issue happens on all our Craft sites (both 2 and 3) on our server, will update as soon as I found out more

Answer 1

Never too late to answer (but fixed weeks ago), apparently our host performed an update on the server that activated several new mod_security rules. One of them was affecting the login.

Answer 2

Template not found: 403.shtml

403.shtml isn't a file that Craft ships with, so most likely it's your web server injecting that into the response of the login POST request for some reason.

Maybe you've got mod_security or Suhosin installed on that server and it's tripping up one of their security rules, for example.

Regardless, it's something you should probably contact your host with as they'll likely be able to help you debug it better.