When accessing the status dashboard with incorrect credentials, the 403 response is cached. Subsequent attempts with correct credentials also result in a 403 response because the cached response is served.
1. Ensure caching is enabled in the Drupal site configuration.
2. Access the status dashboard using incorrect credentials (e.g., invalid API key or user credentials).
3. Observe that the response is a 403 Forbidden.
4. Update the request to use correct credentials.
5. Access the status dashboard again.
6. Observe that the response is still 403 Forbidden, even though the credentials are now valid.
Disable caching for the status dashboard route or endpoint access control.
AccessResult::allowedIf($request->headers->get('x-dashboard-secret') === $secret)->setCacheMaxAge(0);
Active
2.0
Code