I have always used this in my .htaccess:

#  Error document handling:

ErrorDocument   401     /error.php?error=401
ErrorDocument   403     /error.php?error=403
ErrorDocument   404     /error.php?error=404

this works perfectly with PHP on Apache 1.3.x.

Recently, I decided to upgrade PHP and Apache to the newest version of each on a server that I maintain, and first noticed that in directories where I use another .htaccess for password protection, Apache was giving me the 401 page without asking for a username and password, then saying that it was getting a 403 error in trying to load the ErrorDocument.

This made no sense to me, because:

DocumentRoot = /web/mori

drwxrwx--x   24 mordeth  mordeth      4096 Oct  6 21:25 .
-rw-rw-r--    1 mordeth  mordeth      6731 Dec  5  2001 error.php

and in /web:

drwxr-x--x   41 root     web          4096 Oct  1 23:04 .

as you can see...I have the correct perms for Apache to be able to read that document, so I shouldn't be getting 403 errors on it.

After submitting bug #13121 to Apache (http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13121), they reject fixing the problem, instead blaming the problem on PHP:

"This is almost certainly a PHP problem, since the default install includes some SSI-generated error documents that work just fine.  Most likely, the reponse status code is getting lost someplace in the PHP filter.  Please ask on the PHP users mailing list, and if they don't have a solution, report it in the PHP bug database."

I fail to see why it'd be PHP's fault that Apache wouldn't do the Auth before serving the ErrorDocument, but hopefully someone can diagnose this.