403 Forbidden on schema dbchangelog-3.4.xsd from CircleCI.com

General Discussion
1

We’re getting a 403 Forbidden error on the following URL from CircleCI.com

Server returned HTTP response code: 403 for URL: http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.4.xsd

But If I try to get the URL from my local machine it works just fine.

Kind regards

Jan Willem

2

I fixed it by using local XSD files and referencing them instead of depending on the liquibase.org website.

Thanks

3

Hi!

We are getting the same 403 Forbidden response, if we run liquibase from gradle.

After analyzing the http requests, we found out, that with User-Agent: Java/1.8.0_252 we get the 403 Forbidden response, without it, it works fine.

http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd -> 200

4

For a quick workaround we set the Jvm parameter http.agent=curl/7.55.1 and it temporarily resolved the issue.

5

This should be fixed. Are you still getting these errors?

6

I don’t know, we moved the xsd files into the project and referenced the local directory. That fixed the problem immediately

7

Problem is (again) there

$ curl -v --user-agent Java/1.8.0_302 http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.4.xsd
* Connected to www.liquibase.org (141.193.213.10) port 80 (#0)
> GET /xml/ns/dbchangelog/dbchangelog-3.4.xsd HTTP/1.1
> Host: www.liquibase.org
> User-Agent: Java/1.8.0_252
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden

The call ends with 200 OK if the user agent is Java or Java/2 or any other version > 1

8

Working on this issue now with WPEngine support. Will post update shortly.

9

Hi All, can you please test your workflows again and let me know if they are working?

10

@lrkwz I just tried your curl command and it worked for me.

11

RFO here: Tomcat Not Starting, Getting 403 Error From Liquibase - #14 by jnewton

12

Problem is back again. Any request with Java/1 in the header is returing 403.

13

Thank You for reporting this issue. This is now fixed on our side, and you don’t need to change anything to get working again.

What happened:

We recently moved liquibase.org behind a new CDN/security provider. One of its default protections blocks non-standard user agents, including the default agent that Java 8 sends.

What we did:

We’ve specifically allowed Java user agents to pass through. We’ve verified this in production against the XSD and JSON schema URLs. No action is required on your side.

A friendly heads-up for the future:

Older Java 8 clients are increasingly likely to be flagged by security tooling generally, not just ours. We’ll do our best to avoid regressions like this, but there may be a time in the future where we can no longer support Java 8 user agents.

Our recommendations:

  • Upgrade to a current Liquibase release when you can. Modern versions ship the schema definitions inside the distribution and resolve them locally, so they no longer depend on downloading schemas over the network at all.

  • Upgrading Java to a current LTS JRE (17 or 21) is also worth doing when your environment allows.

  • For business-critical database pipelines, consider Liquibase Secure. It adds the hardening, policy controls, and vendor support that teams running Liquibase in production for critical workloads increasingly need, including a direct support path so issues like this get triaged for you rather than surfacing as a broken build. If that’s a fit for your environment, please visit Liquibase Secure.