Using Symfony2’s AccessDeniedHandlerInterface

by

This sounds about right.

Or, if you’re specifically interested in AccessDeniedException you could also define access_denied_handler within your firewall in security.yml:

security:
    firewalls:
        my_firewall:
            # ...
            access_denied_handler: kernel.listener.access_denied.handler
            # ...

Then define your service in your services.xml or equivalent:

<parameters>
    <parameter key="kernel.listener.security.class">Path\To\Your\Class</parameter>
</parameters>

<service id="kernel.listener.access_denied.handler" class="%kernel.listener.security.class%">
    <tag name="kernel.event_listener" event="security.kernel_response" method="handle" />
</service>

The handler class:

use \Symfony\Component\Security\Http\Authorization\AccessDeniedHandlerInterface;

class MyAccessDeniedHandler implements AccessDeniedHandlerInterface
{
    public function handle(Request $request, AccessDeniedException $accessDeniedException)
    {
        // do something with your exception and return Response object (plain message of rendered template)
    }
}

You can find complete Security reference of Symfony2 here: http://symfony.com/doc/2.8/reference/configuration/security.html

More Related Contents:

  1. Symfony2 extending DefaultAuthenticationSuccessHandler
  2. JWT (JSON Web Token) automatic prolongation of expiration
  3. What is token-based authentication?
  4. Authentication versus Authorization
  5. Where to store JWT in browser? How to protect against CSRF?
  6. Non-random salt for password hashes
  7. JWT refresh token flow
  8. Cross Domain Login – How to log a user in automatically when transferred from one domain to another
  9. Where do you store your salt strings?
  10. SPA best practices for authentication and session management
  11. How do I store and retrieve credentials from the Windows Vault credential manager?
  12. Best way for a ‘forgot password’ implementation? [closed]
  13. What is the best Distributed Brute Force countermeasure? [closed]
  14. Should I hash the password before sending it to the server side?
  15. How to do stateless (session-less) & cookie-less authentication?
  16. How to manually decrypt an ASP.NET Core Authentication cookie?
  17. Secure Google Cloud Functions http trigger with auth
  18. Google Authenticator available as a public service?
  19. Best practices for server-side handling of JWT tokens [closed]
  20. What are best practices for securing the admin section of a website? [closed]
  21. Securing an API: SSL & HTTP Basic Authentication vs Signature
  22. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  23. Are HTTP cookies port specific?
  24. Is “double hashing” a password less secure than just hashing it once?
  25. Is it safe to enable CORS to * for a public and readonly webservice?
  26. Convert .pfx to .cer
  27. CSRF protection: do we have to generate a token for every form?
  28. MD5 security is fine? [closed]
  29. Should be used for JSF 2.2 CSRF protection?
  30. Setting cookie in iframe – different Domain

Leave a Comment