SimplePreAuthenticatorInterface在BadCredentialsException上引发500错误

Question

I'm really new to the topic of security customization symfony, following the guides I've created a simple way to authenticate my API.

in case the user dont sent a special header with the token the app throws a

use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Core\Authentication\Token\PreAuthenticatedToken;
use Symfony\Component\HttpFoundation\Request;
//...

public function createToken(Request $request, $providerKey)
{
    if (!$request->headers->has(self::API_TOKEN)) {
        throw new BadCredentialsException('No API key found');
    }

    return new PreAuthenticatedToken('anon.', $request->headers->get(self::API_TOKEN), $providerKey);
}

i dont know exactly what should return symfony, but i know must be a 401 error and not a 500. how i can handle this, I need write my own SimplePreAuthenticationListener ? As i read the idea behind Simple*AuthenticatorInterface is avoid that

Answer 1

Try implementing Symfony\\Component\\Security\\Http\\Authentication\\AuthenticationFailureHandlerInterface in your Authenticator class

public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
    return new Response("Authentication Failed.", 403);
}