Warning: You are browsing the documentation for Symfony 4.0, which is no longer maintained.

Read the updated version of this page for Symfony 5.3 (the current stable version).

How to Create a Custom Access Denied Handler

4.0 version

Maintained

4.4 5.3 current 5.4 dev 6.0

Unmaintained

2.7 2.8 3.1 3.2 3.3 3.4 4.0 4.1 4.2 4.3 5.0 5.1 5.2

How to Create a Custom Access Denied Handler¶

When your application throws an AccessDeniedException, you can handle this exception with a service to return a custom response.

First, create a class that implements Symfony\Component\Security\Http\Authorization\AccessDeniedHandlerInterface. This interface defines one method called handle() where you can implement whatever logic that should execute when access is denied for the current user (e.g. send a mail, log a message, or generally return a custom response):

namespace App\Security;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\Authorization\AccessDeniedHandlerInterface;

class AccessDeniedHandler implements AccessDeniedHandlerInterface
{
    public function handle(Request $request, AccessDeniedException $accessDeniedException)
    {
        // ...

        return new Response($content, 403);
    }
}

If you’re using the default services.yaml configuration, you’re done! Symfony will automatically know about your new service. You can then configure it under your firewall:

YAML

# config/packages/security.yaml
firewalls:
    # ...

    main:
        # ...
        access_denied_handler: App\Security\AccessDeniedHandler

XML

<!-- config/packages/security.xml -->
<config>
    <firewall name="main">
        <access_denied_handler>App\Security\AccessDeniedHandler</access_denied_handler>
    </firewall>
</config>

PHP

// config/packages/security.php
use App\Security\AccessDeniedHandler;

$container->loadFromExtension('security', array(
    'firewalls' => array(
        'main' => array(
            // ...
            'access_denied_handler' => AccessDeniedHandler::class,
        ),
    ),
));

That’s it! Any AccessDeniedException thrown by code under the main firewall will now be handled by your service.

This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.