I'm trying to add a custom access callback function that checks that a user is a specific user (we only want this one api user to have this specific endpoint. It is set up like so:

function my_module_menu() {
    return array(
        '/api/v1/sample/request' => array(
            'page callback' => 'sample_request',
            'access callback' => 'user_is_api_user',
            'type' => MENU_CALLBACK,

function user_is_api_user() {
    watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], true) . "</pre>");
    return $GLOBALS['user']->name == 'api';

If my custom user_is_api_user function returns FALSE, the endpoint just hangs instead of sending back a 403 Forbidden (like expected). Instead, it looks it just keeps retrying because my recent logs just repeat the error not authorized and the watchdog log I put in over and over again until I end the request.

If my custom user_is_api_user returns TRUE, it logs the user in fine. Why does it just look and not actually return 403 forbidden when my custom function return false?

1 Answer 1


To return 403 Forbidden in your callback function, use drupal_access_denied() function something like:

function user_is_api_user() {
  watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], TRUE) . "</pre>");
  if ($GLOBALS['user']->name !== 'api'){
  • Thanks, I'll try this out. Just curious, if I have to invoke drupal_access_denied() method, how come user_is_logged_in does not but it works there?
    – user96646
    Apr 30, 2020 at 19:29
  • i don't understand what you mean by how come user_is_logged_in does not but it works there?
    – berramou
    Apr 30, 2020 at 19:42
  • The user.module provides the method user_is_logged_in that is used as the access callback all around drupal. But all user logged in does is this one line: return (bool) $GLOBALS['user']->uid;. It never calls drupal_access_denied(), yet an endpoint that uses that function as the access callback returns 403 Forbidden when this function returns false. Why does that function just return a boolean, but my function has to call this drupal_access_denied method? Those are inconsistent patterns
    – user96646
    Apr 30, 2020 at 19:49
  • Yes you are right, i just about to test, the 'access callback' function should return a boolean, i miss placed the use of the function, the best way is to use drupal_access_denied() with the condition in your 'page callback' in this case sample_request function and let user_is_api_user as it is
    – berramou
    Apr 30, 2020 at 19:54
  • So just don't use the access callback for what it's for? lol, classic drupal BS
    – user96646
    Apr 30, 2020 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy