{"record":{"id":"2df8b80d57ada763","repo":"yiisoft/yii2","slug":"you-are-not-allowed-to-perform-this-action","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"ForbiddenHttpException","httpStatus":403,"severity":"error","filePath":"framework/filters/AccessControl.php","lineNumber":159,"sourceCode":"            $this->denyAccess($user);\n        }\n\n        return false;\n    }\n\n    /**\n     * Denies the access of the user.\n     * The default implementation will redirect the user to the login page if he is a guest;\n     * if the user is already logged, a 403 HTTP exception will be thrown.\n     * @param User|false $user the current user or boolean `false` in case of detached User component\n     * @throws ForbiddenHttpException if the user is already logged in or in case of detached User component.\n     */\n    protected function denyAccess($user)\n    {\n        if ($user !== false && $user->getIsGuest()) {\n            $user->loginRequired();\n        } else {\n            throw new ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));\n        }\n    }\n}\n","sourceCodeStart":141,"sourceCodeEnd":163,"githubUrl":"https://github.com/yiisoft/yii2/blob/66f00d18a29b520f85e8e8f1e32d1e7e7b556cac/framework/filters/AccessControl.php#L141-L163","documentation":"yii\\filters\\AccessControl::denyAccess() runs when no access rule matched the request with allow=true. If the current user is a guest it calls loginRequired() (redirect to login), but for an authenticated user - or when the User component is detached ($user === false) - it throws ForbiddenHttpException with 'You are not allowed to perform this action.', which Yii renders as HTTP 403.","triggerScenarios":"An action covered by AccessControl's 'only'/'except' list where every rule evaluates false for a logged-in user: roles that the user lacks, 'matchCallback' returning false, verbs/IPs not matching; or a controller using AccessControl in an app where the 'user' component is disabled (user => false).","commonSituations":"RBAC permission not assigned to the user's role (only ['admin'] while user is 'editor'); matchCallback logic bugs (wrong comparison, inverted condition); forgetting that guests get a login redirect only when the User component exists - stateless APIs with a detached user always get 403; deploying new access rules before migrating auth assignments.","solutions":["Adjust the rules so legitimate users match: add the user's role to 'roles', fix the 'verbs'/'ips'/'matchCallback' condition.","Assign the required RBAC permission to the role/user (auth manager assignment migration).","For stateless APIs, configure AccessControl with 'user' => false knowingly and return 401 semantics yourself, or use yii\\filters\\auth\\HttpHeaderAuth instead.","Override denyAccess() in a custom AccessControl subclass to redirect or return JSON instead of a bare 403."],"exampleFix":"// before - logged-in non-admins get 403\n'access' => [\n    'class' => AccessControl::class,\n    'only' => ['delete'],\n    'rules' => [['actions' => ['delete'], 'allow' => true, 'roles' => ['admin']]],\n],\n\n// after - also allow editors, deny everyone else explicitly\n'access' => [\n    'class' => AccessControl::class,\n    'only' => ['delete'],\n    'rules' => [\n        ['actions' => ['delete'], 'allow' => true, 'roles' => ['admin', 'editor']],\n        ['allow' => false],\n    ],\n],","handlingStrategy":"validation","validationCode":"// Before performing a restricted action, check the same rule data AccessControl uses\nif (!Yii::$app->user->can('deletePost')) {\n    throw new \\yii\\web\\ForbiddenHttpException('You are not allowed to perform this action.');\n}\n// or probe the filter configuration before running the action\nforeach ($this->getBehavior('access')->rules as $rule) {\n    if ($rule->allows(Yii::$app->controller->action, Yii::$app->user, Yii::$app->request) !== false) {\n        $allowed = true; break;\n    }\n}","typeGuard":null,"tryCatchPattern":"use yii\\web\\ForbiddenHttpException;\n\ntry {\n    return $this->runAction('delete');\n} catch (ForbiddenHttpException $e) {\n    Yii::$app->session->setFlash('error', 'Insufficient permissions.');\n    return $this->redirect(['index']);\n}","preventionTips":["End every AccessControl rule set with an explicit ['allow' => false] fallback so denial is intentional, not accidental.","Add an RBAC assignment migration whenever a new permission appears in rules, and run it in the same deploy.","Cover access rules with functional tests per role (guest, editor, admin) so missing roles surface in CI.","For stateless APIs set 'user' => false deliberately and return 401-style responses before AccessControl denies."],"tags":["yii2","access-control","rbac","authorization","http-403","filter"],"backgroundTag":"access-denied-403","analyzedSha":"66f00d18a29b520f85e8e8f1e32d1e7e7b556cac","analyzedAt":"2026-08-17T05:17:23.470Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}