I'm trying to set a response on an eventsubscriber that checks if an API authorization token it's correct

class TokenSubscriber implements EventSubscriberInterface
{
    private $em;

    public function __construct(EntityManager $em)
    {
        $this->em = $em;
    }

    public function onKernelController(FilterControllerEvent $event)
    {
        $controller = $event->getController();

        if ($controller[0] instanceof TokenAuthenticatedController) {
            

            $apiKey = $this->em->getRepository('AppBundle:ApiKey')->findOneBy(['enabled' => true, 'name' => 'apikey'])->getApiKey();
            $token = $event->getRequest()->headers->get('x-auth-token');
            if ($token !== $apiKey) {
                //send response
            }
        }
    }

    public static function getSubscribedEvents()
    {
        return [
            KernelEvents::CONTROLLER => 'onKernelController',
        ];
    }
}

But I cant stop the current request and return a respone as a controller, what is the correct way to send a response with an error message and stop the current request

CodePudding user response：

You can not do that using the FilterControllerEvent Event. On that moment, symfony already decided which controller to execute. I think you might want to look into the Symfony Security component. It can protect routes like what you want, but in a slightly different way (access_control and/or annotations).

If you want to block access to an API (eg. JSON), you easily follow this doc. You can also mix it using the Security annotations on your controllers or actions using this doc

CodePudding user response：

I think you can throw an error here

throw new AccessDeniedHttpException('Your message here!');