Symfony2: why access_denied_handler doesn't work

Question

I want to customize the behavior of Symfony2 in case of AccessDeniedException. If the HTTP request which raises the exception is an XMLHTTPRequest then I reply with a JSON otherwise I generate a 302 found to the login page.

Here's my implementation. The log shows that AccessDeneidHandler is never called after an AccessDeniedException. What am I missing ?

#security.yml
firewalls:
    secured_area:
        access_denied_handler: kernel.listener.access_denied.handler

#config.yml
kernel.listener.access_denied.handler:
   class: NoaLisa\Bundle\OVMBundle\DependencyInjection\AccessDeniedHandler
     tags:
        - { name: kernel.event_listener, event: security.kernel_response, method: handle}

#AccessDeniedHandler

class AccessDeniedHandler implements AccessDeniedHandlerInterface{

function handle(Request $request, AccessDeniedException $accessDeniedException){

    if ($request->isXmlHttpRequest()) {
        $response = new Response(json_encode(array('status' => 'protected')));
        return $response;
    }
    else {
        return new RedirectResponse($this->router->generate('login'));
    }
}
}

Darryl Hein · Accepted Answer · 2018-10-30 22:50:04Z

8

Ok finally I found out what was the problem when I dig into ExceptionListener

The service pointed by access_denied_handler is only called if the user has insufficient privilege to access the resource. If the user is not authenticated at all access_dened_handler is never called.

Providing a service to entry_point in security.yml did actually solve the problem.

edited Oct 30, 2018 at 22:50

Darryl Hein

145k96 gold badges224 silver badges265 bronze badges

answered Aug 25, 2012 at 11:50

queto putito

2533 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Carrie Kendall Over a year ago

for anyone who found this answer lacking here is the laid out solution: stackoverflow.com/questions/17428987/…

Mateusz Over a year ago

I had the same problem when trying to figure out why accessing a controller with @Security("is_granted('IS_AUTHENTICATED_FULLY')") was not triggering the handler when $this->isGranted('IS_AUTHENTICATED_REMEMBERED') was true. So the handler is also not called for users authenticated from REMEMBER_ME and accessing resources requiring full authentication. Thanks!

Collectives™ on Stack Overflow

Symfony2: why access_denied_handler doesn't work

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related