A counter increase was missing here.
This should be backported to 1.4 with care, as the code has changed a bit.
s->logs.tv_request = now;
stream_int_retnclose(req->prod, error_message(s, HTTP_ERR_403));
session_inc_http_err_ctr(s);
+ s->fe->fe_counters.denied_req++;
+ if (an_bit == AN_REQ_HTTP_PROCESS_BE)
+ s->be->be_counters.denied_req++;
+ if (s->listener->counters)
+ s->listener->counters->denied_req++;
goto return_prx_cond;
}