Menu
I am doing a check if there is a specific token in my request URI and throw a Symfony\Component\Security\Core\Exception\AccessDeniedException if there is no token or the token is wrong.
if(!isset($token) && $token != 'whatever') { throw new AccessDeniedException('No token given or token is wrong.'); } But when I use this AccessDeniedException, Symfony2 simply redirects to the login page. Instead, I would like to have a dedicated 403 error page (I already created app/Resources/TwigBundle/views/Exceptions/error403.html.twig file).
What would I have to change in order to achieve this? Do I have to use a PHP native Exception? But how can I tell to pass a 403 error code?
Does Symfony2 maybe have a specific 403-Exception which doesn't simply redirect to login?
876
Symfony will handle this exception and generates a response based on the authentication state: If the user is authenticated, but does not have the required permissions, a 403 Forbidden response is generated.
Throw Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException. That will bypass the security system and give you a 403 response which in turn will get picked up by the twig exception listener.
This is the access denied page. It means that we are authenticated, but don’t have access. Of course in Symfony’s prod environment, we’ll be able to customize how this looks. We’ll cover how to customize error pages in the next episode. The access_control section of security.yml is the easiest way to control access, but also the least flexible.
1) AccessDeniedException is a very special exception. When you throw it, it triggers the part of Symfony that tries to get the user to login (usually by redirecting them to /login).
Throw Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException.
That will bypass the security system and give you a 403 response which in turn will get picked up by the twig exception listener.
191
As of Symfony 2.6 you can use the following controller shortcut that will trigger the good exception for you:
return $this->denyAccessUnlessGranted('ROLE_EDIT', $item, 'You cannot edit this item.'); If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
