Why do I get "Access Denied" on every page?

Question

I've been trying out Drupal 8 on localhost which has been great, and I've now transferred it to a server, but every page gives me Access Denied. I can't even access the front page, or the user login page.

I have tried truncating the session and cache tables, and deleting cookies, but don't know what else to try. I've also installed drush, cleared the cache, and tried user-login drush command - still no access.

What things should I check? How do I fix this?

Answer 1

Don't edit core code as suggested by Flounders answer. If you're not using HTTP auth then simply disable the Basic Auth module via the UI or Drush:

drush pmu basic_auth -y

Drupal has different authentication providers. The defaults are: basic_auth and cookie, basic_auth has a higher priority but is not enabled by default.

Answer 2

If you came here with the intention on figuring out why your Drupal 8 site is now throwing Access Denied messages after enabling the Relaxed module (dependency on Workspace which is also dependent on core's Basic_Auth module) you'll want to read this:

https://www.drupal.org/node/2842858

It took me several days of hunting around to finally get the right Google Search query to find the right answer. I hope this finds others in the same spot I was in.

Answer 3

I had this happen to me when I accidentally changed the password of the mysql username that Drupal was using for authentication to the DB. Make sure the DB user/pass is correct in settings.php.

Answer 4

After debugging I found what was the problem for me.

Drupal has some authentication providers. For standard pages this are: basic_auth and cookie (basic_auth has higher priority).

Because test site has a basic_auth from the htaccess, this resulted in that Drupal marked my request as using basic_auth. Only all pages did not require this. Result was just redirect to the 403 page (access denied in the watchdog table)

My temporary fix was the following: Open the file core/modules/basic_auth/src/Authentication/Provider/BasicAuth.php

Go to this code:

public function applies(Request $request) {
    $username = $request->headers->get('PHP_AUTH_USER');
    $password = $request->headers->get('PHP_AUTH_PW');
    return isset($username) && isset($password);
}

Change it to this:

public function applies(Request $request) {
    return false;
    //$username = $request->headers->get('PHP_AUTH_USER');
    //$password = $request->headers->get('PHP_AUTH_PW');
    //return isset($username) && isset($password);
}

If there is a better solution, let me know. But this makes the site working.