Is there a way for debugging "Access Denied" errors in Drupal 8? I'm having some routing/permission issues, and I would like to be able to debug why i'm getting "Access Denied".

  • You can check watch_dog table. Please specifiy latest watchdog table information here so we can identify exact problem.
    – parth.k
    Commented May 31, 2016 at 8:26
  • It's not the exact problem i'm trying to find a solution for. I mostly find it myself by adjusting permissions or configuration, but it often takes some time because there's no clear indication what permission causes the 403. And I checked watchdog, only thing I can see is "access_denied" "route", "timestamp", "user", which I already knew :)
    – pjcarly
    Commented May 31, 2016 at 8:30
  • Have you tried to clear the cache table using drush ? drush cache-clear please try this command for drupal 8.
    – parth.k
    Commented May 31, 2016 at 8:47

2 Answers 2


Install the devel module and then Web Profile module which is bundled with it. You will then see the Symfony web profiler bar below the browser screen. Click on a Request gear icon, and it will show you the route and the controller class. You can start there.

enter image description here

You can also search your code base for that route name and see, if there are additional cases when it is handled.

  • This is usefull if the controller is letting you deny access, but since also elements can throw a denied this is not solely the answer for debugging an access denied. Webprofiler is a cool tool though.
    – absoludo
    Commented Apr 19, 2017 at 10:01
  • I can't see the toolbar, but I do see it in Admin. Is this because I'm anonymous in the page I want to debug?
    – JorgeeFG
    Commented Oct 18, 2018 at 0:04
  • @JorgeeFG The webprofiler for Drupal has a setting to show the toolbar even for anonymous users, if I remember correctly. You just need to check that setting. Commented Oct 18, 2018 at 7:36
  • @AlexeiRayu I didn't find it in the module's settings :(
    – JorgeeFG
    Commented Oct 18, 2018 at 16:10
  • 1
    @JorgeeFG Looked it up - there is a permission "View webprofiler toolbar" in the permissions section that you can assign to anonymous users. Commented Oct 18, 2018 at 16:25

This is super old, but in case anybody, like me, is looking for an answer to this, here's how I did it.

During development, I create a page that allows me to play with and investigate various Drupal services. I'll just give the code I have for that page controller.


 * @file
 * Contains \Drupal\my_module\Controller\MyControllerClass

namespace Drupal\my_module\Controller;

use Drupal\Core\Controller\ControllerBase;
use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
use Drupal\Core\Routing\AccessAwareRouterInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;

class MyControllerClass extends ControllerBase implements ContainerInjectionInterface {

   * The entity type manager.
   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
  protected $entityTypeManager;

   * The router service.
   * @var \Drupal\Core\Routing\AccessAwareRouterInterface
  protected $router;

   * The access manager.
   * @var \Drupal\Core\Access\AccessManagerInterface
  protected $accessManager;

   * The controller class for my testing page.
   * @return array
  public function page() {
    // I create a user account that has the permission(s) I need.
    $account = $this->entityTypeManager->getStorage('user')->load(2);
    // If you need to get the route name:
    $route_name = $this->router->match('/the/path/to/check')['_route'];
    // You can create route parameters if any are needed.
    $parameters = [];
    // Checking the access.
    $debug = $this->accessManager->checkNamedRoute($route_name, $parameters, $account, TRUE);


    return ['#markup' => $this->t('The page markup.')];

When you view the page created by the above controller, it should give you an object with the information about the access check. You can see which AccessResult is returned, and one of the properties of the object is 'reason'.

It will most likely not give you all the answers you need, but it's a place to start.

This should work on both Drupal 8 and Drupal 9. If using Drupal 9, be aware that the Kint module is not part of the Devel module. It is part of the PHP required by Drupal 9. You can check out How to properly setup Devel and Kint on Drupal 9? • AltaGrade. More information about the checkNamedRoute() method: AccessManager::checkNamedRoute | AccessManager.php | Drupal 9.0.x | Drupal API

  • Very nice and helpful. Thank you ! I wrapped that into a drush command so now you can check with drush if a certain user may access a certain url with certain parameters (eg may user xyzzy access /node/123/edit). In case anybody needs that: drupal.org/project/drush_tools/releases/1.0.4 Commented Oct 12, 2022 at 12:10
  • Wow, that's very helpful! But for my case I used route name directly in accessManager: ``` $route_name = 'block.admin_display'; $parameters = []; $debug = \Drupal::accessManager()->checkNamedRoute($route_name, $parameters, $account, TRUE); dump($debug); ``` Commented Apr 4, 2023 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.