We have build a website that for some pages utilises Composer. A dynamic panel we have created is an ImageModule control.

Now, we have extended the site and created some new pages. We are utilizing a product url rewriter, that essentially gets the incoming request url, maps against a repository node, and set the following querystrings:

Request: /m/menu/categoryname/
Display episerver item: /m/menu/category
Mapped episerver item: /menu/categoryname

Querystrings:
id: pagereference id of /m/menu/category item
catid: pagereference id of /menu/categoryname

The /m/menu/category item is a simplepage, and on our local/staging environment seems to be working fine. There doesn't seem to be any reference to compose modules, as it's not required.

What we are seeing though, is on production (in log file), that on each category request to /m/menu/categoryname, a 403: Forbidden access is being thrown, and the log file is saying the Path: '/Controls/Modules/ImageModule.ascx' is forbidden. For the life of me I can't figure out why. Even setting file permissions to everyone everything on that control is not working.

Bit of a headstumper...