After upgrading our application to Drupal 10.6.12, our custom REST resources started failing intermittently.
The same endpoint sometimes returns a successful response (HTTP 200), while the next request returns 400 Bad Request or Access Denied.
Drupal logs consistently report:
Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException: in Drupal\Core\Routing\AccessAwareRouter->checkAccess()
The failing requests are logged as:
User: Anonymous (not verified)
even though the requests originate from an authenticated browser session.
Our REST resources are configured to use both cookie and basic_auth authentication.
The issue started only after upgrading Drupal and is reproducible in both Test and Production environments.
Why now?
This issue did not exist before upgrading to Drupal 10.6.12. We are trying to determine whether there were any changes in Drupal's authentication, session handling, REST routing, or access checking that could cause authenticated requests to intermittently be treated as anonymous users.
CacheableAccessDeniedHttpException with the user shown as Anonymous.Investigate whether Drupal 10.6.x introduced any changes related to:
Any guidance on where to investigate further would be appreciated.
None.
None.
None.
None.
N/A
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | SC-1.png | 168.49 KB | nikhil_110 |
Comments
Comment #2
cilefen commentedWould you please improve the issue summary? It reads "10.x to Drupal 10.6.x", which is imprecise. Because you are asking if there have been any changes to components, state the precise Drupal versions. Additionally, you can check change records and release notes.
Comment #3
longwaveThis does not appear to meet the criteria for a critical bug, downgrading for now.
Reiterating #2: we need to know exactly which versions you upgraded from and to.
Comment #4
nikhil_110 commentedComment #5
nikhil_110 commentedI have attached the relevant screenshots for reference.
After upgrading our application to Drupal 10.6.12, we started experiencing intermittent access issues with our custom REST resources.
The same endpoint sometimes returns a successful response (HTTP 200), while subsequent requests return **400 Bad Request** or **Access Denied**. The Drupal logs consistently show the following exception:
```
Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException
in Drupal\Core\Routing\AccessAwareRouter->checkAccess()
```
For the failed requests, the logs also show:
```
User: Anonymous (not verified)
```
even though the requests are coming from an authenticated browser session.
The issue is reproducible in both the Test and Production environments and started only after upgrading Drupal. Our REST resource is configured to use both `cookie` and `basic_auth` authentication.
Could someone please help identify whether this is a known issue or if there were any changes in Drupal 10.6.x related to authentication, session handling, or access checks that could cause this behavior?
Comment #6
cilefen commentedWhat was the prior version of Drupal that didn’t have the error? You are asking questions that only be answered with that information. As I mentioned in comment #2, you can seek the answers too.
Comment #7
nikhil_110 commented@cilefen I was previously using Drupal 9.5.x, and this issue did not occur there. The problem started only after upgrading to Drupal 10.6.x. I have already checked our custom REST resource configuration and permissions, but the issue persists. I'm trying to understand whether there were any changes in Drupal 10.6.x related to authentication, session handling, or access checks that could cause this behavior.
Comment #8
longwave9.5 to 10.6 is quite the jump, that's a two year period where lots of changes have been made to core and there's not enough information here to help pinpoint exactly where the problem might be.
I would try intermediate versions of core such as e.g. 10.3 to see if the problem exists there - you should be able to narrow it down to a much smaller version range where the problem started, which will make it easier to track down the actual cause.
Comment #9
nikhil_110 commentedA fix has been found. The issue is related to the Flood module, which blocks certain IP addresses when multiple sites access the same URL, due to real-time data fetching.
can close this issue ? Thanks
Comment #10
longwaveThanks for getting back to us.
Comment #12
longwave