# Unauthorized error by calling view

**URL:** <https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437>\
**Category:** Need Help\
**Created:** [February 27, 2025, 2:20pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437 "2025-02-27T14:20:20Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 27, 2025, 2:20pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/1 "2025-02-27T14:20:21Z")

</div>

I have a portal, where you can add posts. If you add a post, or the post will be changed, then you will get an email with a link to your post.  
When you click on the link, it brings you directly to the post. But since you are not logged in, an error message

```auto
Identity is not authorized to perform ``view``

```

I mean, it is ok, if the user is not logged in.  
But what I want to have is, that the user will be redirected to the login page and after login, the user should come back to the post.

---

<div class="post-metadata">

**Author:** ![der-dave](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@der-dave](https://discourse.cakephp.org/u/der-dave)\
**Post date:** [February 27, 2025, 5:31pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/2 "2025-02-27T17:31:47Z")

</div>

Hey efjot,

this could be helpful:  
[Authorization Middleware - 3.x - Handling Unauthorized Requests](https://book.cakephp.org/authorization/3/en/middleware.html#handling-unauthorized-requests)

With the `'queryParam' => 'redirectUrl',` you can return the User back after successfully login.

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 27, 2025, 7:35pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/3 "2025-02-27T19:35:55Z")

</div>

Hi thanks for reply, but do I need to implement the middleware by my owne?  
I don’t understand the example on your linked page.

```auto
$middlewareQueue->add(new AuthorizationMiddleware($this, [
    'unauthorizedHandler' => [
        'className' => 'Authorization.Redirect',
        'url' => '/pages/unauthorized',
        'queryParam' => 'redirectUrl',
        'exceptions' => [
            MissingIdentityException::class,
            OtherException::class,
        ],
    ],
]));

```

Where should I implement this? In my user class? Or in the class I want to open and get the error? Or do I need to create a new class?

When someone tries to open the page without beeing logged in, then I want to show an errormessage and redirect the user to the login page.  
But for now I get an error that the user object in my policy is null.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 27, 2025, 10:10pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/4 "2025-02-27T22:10:21Z")

</div>

Sounds like you’re confused about how middleware works in general. [Middleware - 4.x](https://book.cakephp.org/4/en/controllers/middleware.html) may help you out.

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 28, 2025, 5:05am UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/5 "2025-02-28T05:05:17Z")

</div>

Yes you are right. I am completely confused about middleware and I was not aware that I have to do something.  
I will read the documentation and hope it will be clearer then.  
Thanks a lot.

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 28, 2025, 8:34pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/6 "2025-02-28T20:34:27Z")

</div>

ok, now I added some code.  
In my Application.php in the function middleware, I added a Handler for the ForbiddenException:

```auto
->add(new AuthorizationMiddleware($this, [
                'unauthorizedHandler' => [
                    'className' => 'CustomRedirect',
                    'url' => '/users/login',
                    'queryParam' => 'redirectUrl',
                    'exceptions' => [
                        MissingIdentityException::class,
                        ForbiddenException::class,
                    ],
                    'custom_param' => true,
                ],
            ]));

```

In additional, I added a Custom Redirect

```auto
<?php
declare( strict_types = 1 );

namespace App\Middleware\UnauthorizedHandler;

use Authorization\Exception\Exception;
use Authorization\Middleware\UnauthorizedHandler\RedirectHandler;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

class CustomRedirectHandler extends RedirectHandler {
    public function handle( Exception $exception, ServerRequestInterface $request, array $options = [] ): ResponseInterface {
        $response = parent::handle( $exception, $request, $options );
        $request->getFlash()->error( 'You are not authorized to access that location' );
        return $response;
    }
}

```

I checked it with some debug statement, the file will be loaded and the function handle will be called.  
But the uncaught Exception is still on my page.  
What is wrong?

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 28, 2025, 8:52pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/7 "2025-02-28T20:52:55Z")

</div>

Ahhhh,  
I got it.  
I missed to add the use statement in the Application.php

```auto
use Authorization\Exception\ForbiddenException;

```

Now the exception is catched.  
Only thing is to get redirected. Because this

```auto
'url' => Router::url('/users/login),

```

redirects me to localhost/users/login  
Instead of localhost/myProject/users/login

I think I have to adjust something in router.  
But I am not sure.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 28, 2025, 8:53pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/8 "2025-02-28T20:53:55Z")

</div>

You could try `'url' => ['controller' => 'Users', 'action' => 'login']` and see if it resolves it correctly for you.

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 28, 2025, 8:57pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/9 "2025-02-28T20:57:34Z")

</div>

> [@Zuluru](#):
>
> ‘url’ =\> [‘controller’ =\> ‘Users’, ‘action’ =\> ‘login’]

Unfortunatelly not.

```auto
Argument #1 ($haystack) must be of type string, array given

```

---

<div class="post-metadata">

**Author:** ![KevinPfeifer](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kevinpfeifer/32/3365_2.png) [@KevinPfeifer](https://discourse.cakephp.org/u/KevinPfeifer)\
**Post date:** [March 1, 2025, 6:59am UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/10 "2025-03-01T06:59:35Z")

</div>

try using a string URL instead of an array for this kind of scenario.

I remember having a similar problem due to the fact, that the router has not been setup at that point and therefore not being able to convert the URL array to the corresponding array

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [March 1, 2025, 4:18pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/11 "2025-03-01T16:18:19Z")

</div>

Well, that’s what he was doing, but it wasn’t working. ☹

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [March 2, 2025, 8:20pm UTC](https://discourse.cakephp.org/t/unauthorized-error-by-calling-view/12437/12 "2025-03-02T20:20:35Z")

</div>

Seems that this is a known problem. I found some Threads here.  
[https://discourse.cakephp.org/t/handling-forbidden-exception-for-request-authorization-middleware/6708](https://discourse.cakephp.org/t/handling-forbidden-exception-for-request-authorization-middleware/6708)  
[https://discourse.cakephp.org/t/redirect-to-last-visited-page-after-authorization-fail/10598](https://discourse.cakephp.org/t/redirect-to-last-visited-page-after-authorization-fail/10598)