I've been trying out Drupal 8 on localhost which has been great, and I've now transferred it to a server, but every page gives me Access Denied. I can't even access the front page, or the user login page.

I have tried truncating the session and cache tables, and deleting cookies, but don't know what else to try. I've also installed drush, cleared the cache, and tried user-login drush command - still no access.

What things should I check? How do I fix this?

  • Got the same situation over here. Same code and db locally work fine, but on platform.sh access denied everywhere. Strange. Since this is a top search result, I hope I remember to come back here once I've figured it out. :) Jan 6, 2016 at 21:56

4 Answers 4


Don't edit core code as suggested by Flounders answer. If you're not using HTTP auth then simply disable the Basic Auth module via the UI or Drush:

drush pmu basic_auth -y

Drupal has different authentication providers. The defaults are: basic_auth and cookie, basic_auth has a higher priority but is not enabled by default.

  • 1
    I had similar problem But uninstalling is not the solution. So how do we perform basic authentication? Jan 30, 2017 at 10:53
  • 1
    Please don't edit this answer unless you're actually adding value to it, if you have comments to add, leave a comment.
    – benjy
    Mar 29, 2017 at 3:31
  • uninstall won't solve the problem. we need a basic auth on our Site. Nov 4, 2023 at 6:25

If you came here with the intention on figuring out why your Drupal 8 site is now throwing Access Denied messages after enabling the Relaxed module (dependency on Workspace which is also dependent on core's Basic_Auth module) you'll want to read this:


It took me several days of hunting around to finally get the right Google Search query to find the right answer. I hope this finds others in the same spot I was in.


I had this happen to me when I accidentally changed the password of the mysql username that Drupal was using for authentication to the DB. Make sure the DB user/pass is correct in settings.php.


After debugging I found what was the problem for me.

Drupal has some authentication providers. For standard pages this are: basic_auth and cookie (basic_auth has higher priority).

Because test site has a basic_auth from the htaccess, this resulted in that Drupal marked my request as using basic_auth. Only all pages did not require this. Result was just redirect to the 403 page (access denied in the watchdog table)

My temporary fix was the following: Open the file core/modules/basic_auth/src/Authentication/Provider/BasicAuth.php

Go to this code:

public function applies(Request $request) {
    $username = $request->headers->get('PHP_AUTH_USER');
    $password = $request->headers->get('PHP_AUTH_PW');
    return isset($username) && isset($password);

Change it to this:

public function applies(Request $request) {
    return false;
    //$username = $request->headers->get('PHP_AUTH_USER');
    //$password = $request->headers->get('PHP_AUTH_PW');
    //return isset($username) && isset($password);

If there is a better solution, let me know. But this makes the site working.

  • 3
    You shouldn't edit core code, see my answer for an alternative solution.
    – benjy
    Aug 26, 2016 at 4:49
  • @benjy Your answer is not a solution. Apr 9, 2018 at 14:31
  • Don't ever hack core code. There are better troubleshooting techniques out there.
    – Christian
    Jul 21, 2020 at 6:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.