# Flash error in Authentication Plugin

**URL:** <https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259>\
**Category:** Need Help\
**Created:** [September 20, 2024, 7:22am UTC](https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259 "2024-09-20T07:22:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [September 20, 2024, 7:22am UTC](https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259/1 "2024-09-20T07:22:09Z")

</div>

Hello Everyone!!!, Is Somebody manage to add flash error message in authentication plugin when trying to access a action not include in addUnauthenticatedActions?

public function getAuthenticationService(ServerRequestInterface $request): AuthenticationServiceInterface  
{  
$authenticationService = new AuthenticationService([  
‘unauthenticatedRedirect’ =\> Router::url([‘prefix’ =\> false, ‘controller’ =\> ‘Users’, ‘action’ =\> ‘login’]),  
‘queryParam’ =\> ‘redirect’,  
]);

```
    // Load identifiers, ensure we check email and password fields
    $authenticationService->loadIdentifier('Authentication.Password', [
        'fields' => [
            'username' => ['username', 'email'],
            'password' => 'password',
        ],
        'resolver' => [
            'className' => 'Authentication.Orm',
            'userModel' => 'Users',
            'finder' => 'auth',
        ],
    ]);

    // Load the authenticators, you want session first
    $authenticationService->loadAuthenticator('Authentication.Session');
    // Configure form data check to pick email and password
    $authenticationService->loadAuthenticator('Authentication.Form', [
        'fields' => [
            'username' => 'username',
            'password' => 'password',
        ],
        'loginUrl' => Router::url(['prefix' => false, 'controller' => 'Users', 'action' => 'login']),
    ]);

    $authenticationService->loadIdentifier('RememberMe.RememberMeToken', [
        'fields' => [
            'username' => 'email',
            'password' => 'password',
        ],
        'userTokenFieldName' => 'remember_me_token',
        'tokenStorageModel' => 'RememberMe.RememberMeTokens',
        'resolver' => [
            'className' => 'Authentication.Orm',
            'userModel' => 'Users',
        ],
    ]);
    $authenticationService->loadAuthenticator('RememberMe.Cookie', [
        'fields' => [
            'username' => 'email',
            'password' => 'password',
        ],
        'loginUrl' => Router::url(['prefix' => false, 'controller' => 'Users', 'action' => 'login']),
        'rememberMeField' => 'remember_me',
        'cookie' => [
            'name' => 'rememberMe',
            'expires' => '+30 days',
            'secure' => true,
            'httpOnly' => true,
        ],
        'tokenStorageModel' => 'RememberMe.RememberMeTokens',
        'always' => false,
        'dropExpiredToken' => true,
    ]);

    return $authenticationService;
}

```

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [September 20, 2024, 2:49pm UTC](https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259/2 "2024-09-20T14:49:21Z")

</div>

Have you looked at [Authorization Middleware - 1.1](https://book.cakephp.org/authorization/1/en/middleware.html#handling-unauthorized-requests)? You don’t generate flash messages from the authentication, but from some middleware handling an exception thrown by the authentication.

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [September 21, 2024, 8:19am UTC](https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259/3 "2024-09-21T08:19:15Z")

</div>

I see that but I dont use it

```
->add(new AuthorizationMiddleware($this, [
            'requireAuthorizationCheck' => false,
        ]));

```

cause I thought it will not work because of this

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [September 21, 2024, 8:59am UTC](https://discourse.cakephp.org/t/flash-error-in-authentication-plugin/12259/4 "2024-09-21T08:59:22Z")

</div>

```
        ->add(new AuthorizationMiddleware($this, [

```

// ‘requireAuthorizationCheck’ =\> true,  
‘unauthorizedHandler’ =\> [  
‘className’ =\> ‘Authorization.CustomRedirect’,  
‘exceptions’ =\> [  
\Authorization\Exception\MissingIdentityException::class,  
\Authorization\Exception\ForbiddenException::class,  
],  
],  
]));

\<?php declare( strict\_types = 1 ); namespace App\Middleware\UnauthorizedHandler; use Authorization\Exception\Exception; use Authorization\Middleware\UnauthorizedHandler\RedirectHandler; use Psr\Http\Message\ResponseInterface; use Psr\Http\Message\ServerRequestInterface; use Cake\Http\Session; class CustomRedirectHandler extends RedirectHandler { public function handle(Exception $exception, ServerRequestInterface $request, array $options = []): ResponseInterface { // Get session from the request $session = $request-\>getAttribute('session'); if ($session instanceof Session) { // Write the flash message into the session $session-\>write('Flash.flash', [[ 'message' =\> 'You are not authorized to access that location.', 'key' =\> 'flash', 'element' =\> 'flash/default', 'params' =\> [] ] ]); } // Call the parent handler to manage the redirect return parent::handle($exception, $request, $options); } } I try this solution the flash does not appear