I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my services.yml and referencing it in the .yml of the resource, it is called for each route, not just my resources, as logging reveals. Yes, I can inject a RouteMatchInterface into my auth provider and use the applies() function to check whether the provider should be consulted on a specific route but why is this required?

Can't I limit my provider to only the resource I plan to use it with? Using applies() not only means extra overhead on each call, it makes it awkward to maintain, needing to modify usage in both places, the config files and the auth provider source code.

  • Well, the comments in AuthenticationProviderFilterInterface do suggest a probable cause, so this might be the sad truth after all...
    – Gábor
    Aug 24, 2022 at 14:37
  • Yes, applying an authentication provider and checking the route requirements are two different things happening at different times.
    – 4uk4
    Aug 24, 2022 at 14:48
  • But then, what's the point of checking what auth is supported for a given resource, if all will be called, anyway?
    – Gábor
    Aug 24, 2022 at 15:14
  • Normally applies() should not contain time consuming code, it just checks for credentials provided in the request. If someone provides credentials for a REST service, but calls a non-API URL, Drupal will respond with a 403.
    – 4uk4
    Aug 24, 2022 at 16:22
  • That's what one of my provider's ˙applies()` does. But the second one would need to provide anonymous access (no CSRF token or cookie or anything similar required at all). I have nothing to check for in that applies() and returning TRUE clearly breaks the whole site. That's why it's a trouble I can't force this provider to only apply to a single, specific route.
    – Gábor
    Aug 24, 2022 at 16:26

1 Answer 1


I'm running into a related issue. In my case, using the applies() method in my custom provider makes sense.

What's bothering me is it's behaviour. When applies() returns FALSE, it goes directly to the REST resource plugin and (for example) will execute my PATCH request. After what it goes to the authenticate() method of the provider.

I don't understand this logic, as it seems to me that the authenticate should be validated before executing the REST request. So we don't process a request for nothing in case of failed authentication.

Any thoughts ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.