Custom AccessDeniedHandler didn't work

[y4roc]

Symfony version(s) affected: 4.1.3

Description
Symfony ignores the custom AccessDeniedHandler. It never will called.

How to reproduce
Read (http://symfony.com/doc/current/security/access_denied_handler.html) and build it in a clean Symfony project. Secure an URL an called it. You will see, this your handler will never called.

[xabbuh]

Can you please create a small example project that allows to reproduce your issue?

[seferov]

Access denied handler is working in \Symfony\Component\Security\Http\Firewall\ExceptionListener::handleAccessDeniedException. However, if current user is not fully fledged instead of AccessDeniedException, InsufficientAuthenticationException is thrown and return before the handler. I guess this is the problem that @thHAN is facing. I don't know if this is expected behaviour but if so there should be a note about this in the documentation.

On the error page it is also seen that first AccessDeniedException, then InsufficientAuthenticationException is thrown.

[nicoweb]

Same problem, if I follow the doc (http://symfony.com/doc/current/security/access_denied_handler.html),
my custom Access Denied Handler Handler is never called

[xabbuh]

@seferov @nicoweb Can one of you create a small example application that allows to reproduce your issue?

[nicoweb]

@xabbuh Here a small example: https://github.com/nicoweb/symfony-issue_28229
If I delete the return here, my custom AccessDeniedHandler is executed.

[y4roc]

@nicoweb reproduce my problem. I can't give more informations about this issue.

[WestFR]

Same problem for me when i use this following : https://symfony.com/doc/current/security/access_denied_handler.html

[Floeig]

Same problem here, I followed the @nicoweb, to delete the return and worked as expected. I found another way to have the same result here multiple_guard_authenticators

[otatarintseva]

Did you try to change app/config/services.yml? Mayby it is just documentation issue? I used AccessDeniedHandler in Symfony 2.8 and it works for me. I configured it according to https://symfony.com/doc/2.8/security/access_denied_handler.html.

[curry684]

No the issue is real and #30423 is in itself the proper fix.

Status: reviewed

[chalasr]

Patch reverted, reopening.

[clevercodenl]

when is this getting fixed ???

[xabbuh]

@GreenLeewayDesignCastle Would you like to create a pull request?

[clevercodenl]

@GreenLeewayDesignCastle Would you like to create a pull request?

I'll try to, keep you posted

[nesk]

Patch reverted, reopening.

Why was it reverted? What was wrong with the patch provided by fabpot?

[DariuszLuber]

Exactly the same situation - steps taken from doc: https://symfony.com/doc/current/security/access_denied_handler.html
Symfony version: 4.2.7
Any sugestion to get it work?

[nesk]

@chalasr Sorry to insist, but why the patch has been reverted? What was wrong with it and what can we do to help fix this really annoying issue?

[walva]

Hi everyone, I am also having an issue with Symfony\Component\Security\Core\Exception\ AccessDeniedException.
If a user tries to access an entity for which he has no access, the @IsGranted("PARTNER_VIEW", subject="center") annotation throws an AccessDeniedException.
Even if the user is logged in, symfony will redirect him to the login page instead of having an error page.

Is this the expected behavior of symfony: redirect a logged user to the login page when an AccessDeniedException is thrown?

I created an AccessDeniedHandler in my application that will display an error page if there is a user logged by following this documentation: https://symfony.com/doc/master/security/access_denied_handler.html.
It works. I'm using 4.2.8.

Btw, in the accessDeniedHandler, the call $request->getUser() returns null. Is this the expected behavior? To access the user, I have to inject the TokenStorageInterface service.

[nesk]

I've managed to mitigate the bug by creating a subscriber listening for thrown AccessDeniedException. I check the stack trace of the exception, if the firewall threw it then I do nothing, otherwise I return my own response with a 403 status code.

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent;
use Symfony\Component\HttpKernel\KernelEvents;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\Firewall\AccessListener;

class AccessDeniedSubscriber implements EventSubscriberInterface
{
    public function onKernelException(GetResponseForExceptionEvent $event): void
    {
        $exception = $event->getException();

        if ($exception instanceof AccessDeniedException && !self::isThrownByFirewall($exception)) {
             // Create your own response like in a custom access denied handler
             $response = new Response('blablabla', 403);

            $event->setResponse($response);
            $event->stopPropagation();
        }
    }

    public static function getSubscribedEvents()
    {
        return [
            // Define the priority to execute our subscriber before the one from the security component
            KernelEvents::EXCEPTION => ['onKernelException', 1],
        ];
    }

    /**
     * Determines, by analyzing the stack trace, if an exception has been thrown by the firewall.
     */
    private static function isThrownByFirewall(\Throwable $exception): bool
    {
        foreach ($exception->getTrace() as $stackItem) {
            $class = $stackItem['class'] ?? null;
            if ($class === AccessListener::class) {
                return true;
            }
        }

        return false;
    }
}

Once the bug is fixed by Symfony devs, you will have to use a real custom access denied handler and delete this subscriber (it could break easily with a future Symfony update).

[rostandnj]

I have solved the problem by changing
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
with
use Symfony\Component\Security\Core\Exception\AccessDeniedException;

in the AccessDeniedHandler class

[nesk]

Patch reverted, reopening.

Why was it reverted? What was wrong with the patch provided by fabpot?

Asking the same question again… If you want people to help, you have to explain why the patch created by @fabpot was reverted, otherwise we will never be able to make progress on this issue.

[xabbuh]

see #31136 for the context of why the fix was reverted

[nesk]

So, if I understand correctly, this patch brought BC issues to the 3.X and 4.X branches? I understand why it was reverted, but why the patch has not been merged in the master branch? Should I create a PR for this?

(And thank you for the answer 🙂)

[michaelKaefer]

Based on the workaroung of @nesk for Symfony 5 you can use this workaround until this issue is solved. As soon as it is solved it should be enough to simply delete the file EventSubscriber.php:

<?php

namespace App\EventSubscriber;

use App\Security\AccessDeniedHandler;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ExceptionEvent;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\Firewall\AccessListener;

/**
 * This is a temporary workaround until https://github.com/symfony/symfony/issues/28229 is solved.
 *
 * @package App\EventSubscriber
 */
class AccessDeniedSubscriber implements EventSubscriberInterface
{
    private $handler;

    public function __construct(AccessDeniedHandler $handler)
    {
        $this->handler = $handler;
    }

    public function onKernelException(ExceptionEvent $event)
    {
        $exception = $event->getThrowable();

        if ($exception instanceof AccessDeniedException && !self::isThrownByFirewall($exception)) {
            $response = $this->handler->handle($event->getRequest(), $exception);

            $event->setResponse($response);
            $event->stopPropagation();
        }
    }

    public static function getSubscribedEvents()
    {
        return [
            'kernel.exception' => ['onKernelException', 1],
        ];
    }

    /**
    * Determines, by analyzing the stack trace, if an exception has been thrown by the firewall.
    *
    * @param AccessDeniedException $exception
    *
    * @return bool
    */
    private static function isThrownByFirewall(AccessDeniedException $exception): bool
    {
        foreach ($exception->getTrace() as $stackItem) {
            $class = $stackItem['class'] ?? null;
            if ($class === AccessListener::class) {
                return true;
            }
        }

        return false;
    }
}

[HamHamFonFon]

I'have the same problem but i fixed it by throwing

Symfony\Component\Security\Core\Exception\AccessDeniedException

And not Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException or other AccessDeniedException

[elevado]

Once the bug is fixed by Symfony devs, you will have to use a real custom access denied
handler and delete this subscriber (it could break easily with a future Symfony update).

Thanks, it works!

[eerison]

I'm using Symfony 4.4.10, and It works if I put statusCode=403 in @IsGranted

e.g

@IsGranted("ROLE_ADMIN", statusCode=403)

[wouterj]

I've tested this in a real Symfony app and I think this issue is mostly due to confusion about the purpose of the AccessDeniedHandler. It's only meant to be called when a user is authenticated (thus not anonymous), but does not have enough permissions to access the resource. An authentication entry point is meant to catch the anonymous users trying to access a protected resource.

Based on my experiments, I've created a PR to better document this: symfony/symfony-docs#14045

I think this issue can be closed, the access denied handler is working like expected in my tests.