The Jenny module implements an API and needs to authenticate based on this header...

Authorization: Jenny 8675309

Here is my API route...

  path: '/api/jenny'
    _controller: '\Drupal\jenny\Controller\ApiController::get'
  methods: [GET]
    _access: 'TRUE'

The API returns data for any type of user, but for some roles additional data is included.

Here is my implementation for AuthenticationProviderInterface...

public function applies(Request $request) {
  if ($header = $request->headers->get('Authorization')) {
    if(strpos($header, 'Jenny ') !== FALSE) {
      \Drupal::logger('jenny')->info('this applies');
      return TRUE;
  return FALSE;

public function authenticate(Request $request) {
  return $this->entityTypeManager->getStorage('user')->load(1);

This example code authenticates the admin user whenever there is an Authorization: Jenny header. Obviously the real code implements the logic to authenticate the proper user.

Here's what shows up in the log...

uid  type            message
0    jenny           this applies
0    jenny           this applies
0    jenny           authenticate
1    jenny           this applies
1    jenny           this applies
1    jenny           this applies
1    accesss denied  /api/jenny

It shows the uid changing, so it suggests that my authentication provider is doing it's part, but for some reason it's still coming back 403 access denied even though the route is _access: 'TRUE'. A request for /api/jenny without an Authorization: Jenny header returns the expected data.

This makes no sense to me. Could someone please point out what I'm doing wrong or why this isn't working? Thanks.

Upon further review, this is happening on all routes if there is an Authorization: Jenny header, even though the authentication provider is returning the admin user.

1 Answer 1


Routes need to specify the authentication providers they want to support.

By default, that's session, so authenticating with something else is not allowed.

You do this by specifying _auth: ['your_authentication_provider'] within the options: key of your route.

  • Thank you, this is correct. I actually added that to my route this morning and it still wasn't working. Didn't notice the typo until I double checked it after reading your answer. The documentation for it doesn't read that way, but it does make my route work now.
    – konadave
    Aug 25, 2017 at 20:09
  • I was helped a lot by this answer, but it took me some time to find out that the priority of the custom authentication provider has to be high (I used Priority: 1000), otherwise the 403 error keeps on occurring. I don't understand why, as in the _auth vector there was only my custom provider, yet this is the case. Dec 13, 2021 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.