Routes should not only have request-dependent access checks

Created on 25 January 2021, almost 4 years ago
Updated 2 February 2023, almost 2 years ago

Problem/Motivation

Routing access checks can declare that they need the request by specifying needs_incoming_request: TRUE

\Drupal\Core\Access\AccessManager::check() is only passed the request when checking the incoming request. It is not passed a request when checking routes on output (like when rendering menu links, local tasks, etc).

If all of the access checks are dependent on the request, the result will be AccessResult::neutral() (aka access denied).
This is correct behavior, but can be confusing.

Proposed resolution

If all access checks are dependent on the request, warn the developer.
Currently, attempt to do that via a deprecation.

Remaining tasks

  1. Decide if this should be a deprecation or just written to the log
  2. Determine if this is the best place to do this, or if it can be accomplished during router rebuild

User interface changes

N/A

API changes

TBD

Data model changes

N/A

Release notes snippet

TBD

πŸ› Bug report
Status

Needs work

Version

10.1 ✨

Component
RoutingΒ  β†’

Last updated 3 days ago

Created by

πŸ‡ΊπŸ‡ΈUnited States tim.plunkett Philadelphia

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request β†’ as a guide.

    Think this will need a test case to show the issue. Patch needs to be updated for the trigger_error pattern.

Production build 0.71.5 2024