I'm trying to add a custom access callback function that checks that a user is a specific user (we only want this one api user to have this specific endpoint. It is set up like so:

function my_module_menu() {
    return array(
        '/api/v1/sample/request' => array(
            'page callback' => 'sample_request',
            'access callback' => 'user_is_api_user',
            'type' => MENU_CALLBACK,

function user_is_api_user() {
    watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], true) . "</pre>");
    return $GLOBALS['user']->name == 'api';

If my custom user_is_api_user function returns FALSE, the endpoint just hangs instead of sending back a 403 Forbidden (like expected). Instead, it looks it just keeps retrying because my recent logs just repeat the error not authorized and the watchdog log I put in over and over again until I end the request.

If my custom user_is_api_user returns TRUE, it logs the user in fine. Why does it just look and not actually return 403 forbidden when my custom function return false?


To return 403 Forbidden in your callback function, use drupal_access_denied() function something like:

function user_is_api_user() {
  watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], TRUE) . "</pre>");
  if ($GLOBALS['user']->name !== 'api'){
| improve this answer | |
  • Thanks, I'll try this out. Just curious, if I have to invoke drupal_access_denied() method, how come user_is_logged_in does not but it works there? – TheSnowboardingDev Apr 30 at 19:29
  • i don't understand what you mean by how come user_is_logged_in does not but it works there? – berramou Apr 30 at 19:42
  • The user.module provides the method user_is_logged_in that is used as the access callback all around drupal. But all user logged in does is this one line: return (bool) $GLOBALS['user']->uid;. It never calls drupal_access_denied(), yet an endpoint that uses that function as the access callback returns 403 Forbidden when this function returns false. Why does that function just return a boolean, but my function has to call this drupal_access_denied method? Those are inconsistent patterns – TheSnowboardingDev Apr 30 at 19:49
  • Yes you are right, i just about to test, the 'access callback' function should return a boolean, i miss placed the use of the function, the best way is to use drupal_access_denied() with the condition in your 'page callback' in this case sample_request function and let user_is_api_user as it is – berramou Apr 30 at 19:54
  • So just don't use the access callback for what it's for? lol, classic drupal BS – TheSnowboardingDev Apr 30 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.