BeforeActionAuthorizationDeniedEvent
New in version 14.2 Feature: #107826 - Introduce Extbase action authorization attribute
The PSR-14 event
\TYPO3\ is
dispatched when an Extbase action is protected with
#[Authorize]
and one of its checks fails. The event is dispatched before the action is
called.
get returns which check has failed: the login, the
groups, or the callback.
Without a listener, or when no listener calls
set, Extbase
answers with
HTTP 403 Forbidden.
When the site has an error handler configured for status 403, that handler
renders the response.
Example: log denied access to Extbase actions
The following listener writes a log entry for each denied request. It does not set a response, so the visitor still gets a 403 response:
<?php
declare(strict_types=1);
namespace MyVendor\MyExtension\EventListener;
use Psr\Log\LoggerInterface;
use TYPO3\CMS\Core\Attribute\AsEventListener;
use TYPO3\CMS\Extbase\Event\Mvc\BeforeActionAuthorizationDeniedEvent;
final readonly class LogDeniedActionAccessListener
{
public function __construct(
private LoggerInterface $logger,
) {}
#[AsEventListener('my_extension/log-denied-action-access')]
public function __invoke(BeforeActionAuthorizationDeniedEvent $event): void
{
$this->logger->notice('Access to an Extbase action was denied', [
'controller' => $event->getControllerClassName(),
'action' => $event->getActionMethodName(),
'reason' => $event->getFailureReason()->value,
]);
}
}
Warning
A listener that calls
set must not change any domain objects
or use Extbase persistence: the action has not run yet. Set a response
only for uncached actions. In a cached action, the response goes into the
page cache and all visitors get it, whether they have access or not.
API
-
class
BeforeActionAuthorizationDeniedEvent -
- Fully qualified name
-
\TYPO3\CMS\ Extbase\ Event\ Mvc\ Before Action Authorization Denied Event
Event that is triggered when an extbase action authorization check fails and before the authorization denied PropagateResponseException is thrown. Extension developers can use this event to prevent the default behavior and provide a custom response.
Security notice: When providing a custom response, it must be ensured, that no objects are persisted using the extbase persistence layer. Additionally it is recommended to only use a custom response for non-cached actions, because otherwise the response result will get cached.