EDIT: did more research, asked new questionI dug a bit deeper and realized that the contents of the page are indeed not relevant to this issue.  As this question has gotten more and more confusing, I've asked a new question to avoid further muddying the waters.EDIT: did some more detective workI've created the following file to display query string parameters and set it up on my webserver:<!DOCTYPE html> <html> <body> <script src=URI.js></script><script>var bodyEl = document.getElementsByTagName(body)[0];var url = URI(document.documentURI);var options = URI.parseQuery(url.query());var optionsDiv = document.createElement(div);var optionsText = ;for (o in options) {  optionsText +=  + o + :  + options[o] + \n;}optionsDiv.innerText = optionsText;bodyEl.appendChild(optionsDiv);</script></body></html>It works as expected given the URL http://example.com/querytest/querytest.html?a=1&b=2.When I send it query string parameters containing a %-escaped url, I get a 403 error from the webserver.Example URL: http://example.com/querytest/querytest.html?a=1&b=2&source_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D2Tjp0mRb4XAHowever, if I substitute example.com for www.youtube.com in the %-escaped URL, I do not get a 303.Based on this, I'm guessing that the library I'm using to parse the URL (URI.js) is doing something with the url that violates the same origin policy.Original postI'm using shared hosting, i.e. I have no ability to modify the apache installation, root configuration files, etc.  I'm developing a web app that passes URLs as query string parameter values.  The web server is giving a 403 FORBIDDEN error whenever the query string contains a period character, even if that character is %-escaped  i.e. either .or%2E` in a query string value will trigger the 403.It seems that the web server thinks that the file extension is everything after the final . in the query string.  How can I get it to act sensibly and realize that it's just part of the query string?A .htaccess file in the web app's directory is used by Apache.  I tried creating one containing the following line, but it didn't do the trick.  It's been a while since I worked with Apache config, so I'm not surprised.  The second line serves to verify that Apache is actually reading the local .htaccess file.RewriteRule ^app.html$ app.html [L,NC,NS,QSA]RewriteRule ^app$ app.html [L,NC,NS,QSA]Note: originally posted on Stack Overflow but received little attention and no responses.
403 when query string contains a dot (.) character
htaccess;apache;403 forbidden