{"record":{"id":"a21f50f4d109ba3e","repo":"phalcon/cphalcon","slug":"access-denied-for-type-name","errorCode":null,"errorMessage":"Access denied for {type} '{name}'","messagePattern":"Access denied for (.+?) '(.+?)'","errorType":"exception","errorClass":"Phalcon\\Auth\\Exceptions\\AccessDenied","httpStatus":null,"severity":"error","filePath":"phalcon/Auth/AbstractAuthDispatcherListener.zep","lineNumber":80,"sourceCode":"        let access = this->manager->getAccess();\n        if (access === null) {\n            return true;\n        }\n\n        if (access->isAllowed(this->manager->guard(), actionName, context)) {\n            return true;\n        }\n\n        if (forwardHandler !== null) {\n            let target = access->redirectTo();\n            if (target !== null) {\n                {forwardHandler}(target);\n\n                return false;\n            }\n        }\n\n        throw new AccessDenied(this->getActionType(), actionName);\n    }\n\n    /**\n     * Returns the kind label used by AccessDenied (e.g. 'task', 'action',\n     * 'route').\n     */\n    abstract protected function getActionType() -> string;\n}\n","sourceCodeStart":62,"sourceCodeEnd":89,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Auth/AbstractAuthDispatcherListener.zep#L62-L89","documentation":"The Auth dispatcher listener enforces access via an access gate (e.g. Phalcon\\Auth\\Access\\Acl). When the gate denies an action, the listener first tries to recover by forwarding to a redirect target; only if no forward handler is available or the access policy exposes no redirectTo() does it throw AccessDenied labelled with the action type ('task', 'action', 'route') and the action name. It is the terminal signal that a request was refused and no graceful redirect was configured.","triggerScenarios":"`$listener->enforce($actionName, $context, $forwardHandler)` (or the dispatcher event that calls it) where the gate's isAllowed() returns false and either forwardHandler is null or the access object's redirectTo() returns null.","commonSituations":"Wiring the new Phalcon Auth component without configuring a redirect for denied users; ACL rules missing an allow entry for the user's role; forgetting to add a public action to the access policy's exceptActions.","solutions":["Grant access: add the matching `$acl->allow($role, $component, $action)` rule or assign the user the required role","Configure graceful denial: set redirectTo() on the access policy and pass a forward handler to enforce() so refusals forward (e.g. to login) instead of throwing","Whitelist genuinely public actions in the access policy's exceptActions"],"exampleFix":"// before: denial throws\n$this->enforce('index', $context, null);\n// after: denial forwards to login\n$this->enforce('index', $context, function (array $target) {\n    $this->dispatcher->forward(['controller' => 'session', 'action' => 'login']);\n});\n// plus in the access policy: protected function redirectTo(): ?array { return ['controller' => 'session', 'action' => 'login']; }","handlingStrategy":"try-catch","validationCode":"if (!$acl->isAllowed($user->getRoleName(), $component, $actionName)) {\n    $response->redirect('/login')->send();\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    $dispatcher->dispatch();\n} catch (\\Phalcon\\Auth\\Exceptions\\AccessDenied $e) {\n    $logger->notice('Access denied: ' . $e->getMessage());\n    $response->setStatusCode(403)->setContent('Forbidden')->send();\n}","preventionTips":["Always configure redirectTo() on access policies and pass a forward handler to enforce() so denials redirect rather than throw","Keep ACL rules per role/component/action in config reviewed alongside new routes","List public actions in exceptActions explicitly instead of relying on deny-all + exception handling"],"tags":["auth","acl","authorization","dispatcher","access-denied"],"backgroundTag":"access-denied-403","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}