[3.4.25][BC Break] 403 instead of 401 for unauthorized users

[JarJak]

Symfony version(s) affected: 3.4.25

Description
Symfony now returns 403 instead of 401 for unauthorized users.

How to reproduce

1. Create controller with a security voter like $this->denyAccessUnlessGranted(...)
2. Try to access this route with an unauthorized user
3. Observe different status codes (401 in 3.4.24 vs 403 in 3.4.25)

Possible Solution
Undo this change, or at least provide instructions how to revert to old behavior, or at least mention it explicitly in the changelog / upgrade files.
Even if the change is good (IMO 403 is better, see http://www.dirv.me/blog/2011/07/18/understanding-403-forbidden/index.html) this is a BC Break for apps that react on 401 status but not on 403.

[curry684]

It's most certainly more correct according to protocol.

[JarJak]

But it's a BC break and not a security issue.

[curry684]

I agree, I even mentioned it before that it's a BC break because of the behavioral change. I didn't foresee it would cause the other return code though, nor did any of the other reviewers apparently.

I'd say revert it in 3.4 an 4.2 and ship the change with documentation for 4.3.

[nicolas-grekas]

A BC break wouldn't be more acceptable in 4.3 than in 3.4.25.
And any bug fix in a BC break for someone.
We have to decide where we stand between these two lines.

[JarJak]

@nicolas-grekas it depends what you define by bug fix... this one was only about status code change from 401 to 403 and definitions of these codes are soft... it is more an improvement than a bug fix

[fabpot]

I think it should have been merged in master instead.

[curry684]

And any bug fix in a BC break for someone.

Yes we decided then to ignore the behavioral break per the "it's a break for everyone" argument, but nobody correctly foresaw the functional break. 403 instead of 401 could cause far greater breakage, ie. in external API clients etc.

[JarJak]

@fabpot Can it be reverted in 3.4.26? Because now I won't be able to update a version if i.e. real security issue comes up. For now I've just added 3.4.25 in conflict part of composer.json.

[nicolas-grekas]

Please send PRs

[JarJak]

@nicolas-grekas It's just about reverting fd1408b on 3.4 branch. @curry684 @dimabory do you agree?

[chalasr]

See #31142.