I'm trying to add a custom access callback function that checks that a user is a specific user (we only want this one api user to have this specific endpoint. It is set up like so:

function my_module_menu() {
    return array(
        '/api/v1/sample/request' => array(
            'page callback' => 'sample_request',
            'access callback' => 'user_is_api_user',
            'type' => MENU_CALLBACK,

function user_is_api_user() {
    watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], true) . "</pre>");
    return $GLOBALS['user']->name == 'api';

If my custom user_is_api_user function returns FALSE, the endpoint just hangs instead of sending back a 403 Forbidden (like expected). Instead, it looks it just keeps retrying because my recent logs just repeat the error not authorized and the watchdog log I put in over and over again until I end the request.

If my custom user_is_api_user returns TRUE, it logs the user in fine. Why does it just look and not actually return 403 forbidden when my custom function return false?


To return 403 Forbidden in your callback function, use drupal_access_denied() function something like:

function user_is_api_user() {
  watchdog("GLOBALS", "<pre>" . print_r($GLOBALS['user'], TRUE) . "</pre>");
  if ($GLOBALS['user']->name !== 'api'){
  • Thanks, I'll try this out. Just curious, if I have to invoke drupal_access_denied() method, how come user_is_logged_in does not but it works there?
    – user96646
    Apr 30 '20 at 19:29
  • i don't understand what you mean by how come user_is_logged_in does not but it works there?
    – berramou
    Apr 30 '20 at 19:42
  • The user.module provides the method user_is_logged_in that is used as the access callback all around drupal. But all user logged in does is this one line: return (bool) $GLOBALS['user']->uid;. It never calls drupal_access_denied(), yet an endpoint that uses that function as the access callback returns 403 Forbidden when this function returns false. Why does that function just return a boolean, but my function has to call this drupal_access_denied method? Those are inconsistent patterns
    – user96646
    Apr 30 '20 at 19:49
  • Yes you are right, i just about to test, the 'access callback' function should return a boolean, i miss placed the use of the function, the best way is to use drupal_access_denied() with the condition in your 'page callback' in this case sample_request function and let user_is_api_user as it is
    – berramou
    Apr 30 '20 at 19:54
  • So just don't use the access callback for what it's for? lol, classic drupal BS
    – user96646
    Apr 30 '20 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy