CakePHP 5中间件权限校验后无法重定向问题求助

1. 修正Policy的返回逻辑 #

默认授权中间件在权限验证失败时会抛出ForbiddenException，而非直接触发重定向。确保你的Policy方法在验证不通过时抛出异常，而非仅返回false：

// src/Policy/ArticlePolicy.php
namespace App\Policy;

use App\Model\Entity\Article;
use App\Model\Entity\User;
use Cake\Authorization\Exception\ForbiddenException;

class ArticlePolicy
{
    public function view(User $user, Article $article): bool
    {
        if ($user->id === $article->user_id) {
            return true;
        }
        throw new ForbiddenException('无权限访问该文章');
    }
}

2. 自定义重定向中间件 #

创建自定义中间件捕获授权异常并处理重定向，放在src/Middleware/RedirectOnFailureMiddleware.php：

namespace App\Middleware;

use Cake\Http\Response;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Cake\Authorization\Exception\ForbiddenException;

class RedirectOnFailureMiddleware implements MiddlewareInterface
{
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        try {
            return $handler->handle($request);
        } catch (ForbiddenException $e) {
            // 按需修改重定向目标，比如登录页或首页
            return new Response()
                ->withStatus(302)
                ->withHeader('Location', '/');
        }
    }
}

3. 调整中间件加载顺序 #

在src/Application.php的middleware()方法中，将自定义重定向中间件放在AuthorizationMiddleware之后、ErrorHandlerMiddleware之前：

// src/Application.php
public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue
{
    $middlewareQueue
        // ...其他中间件（比如Routing、BodyParser等）
        ->add(new AuthorizationMiddleware($this))
        ->add(new \App\Middleware\RedirectOnFailureMiddleware())
        ->add(new ErrorHandlerMiddleware(Configure::read('Error')));

    return $middlewareQueue;
}

4. 验证授权服务配置 #

确保src/Application.php的bootstrap()和getAuthorizationService()配置正确加载Policy：

// src/Application.php
public function bootstrap(): void
{
    parent::bootstrap();
    $this->addPlugin('Authorization');
}

public function getAuthorizationService(ServiceLocatorInterface $services): AuthorizationServiceInterface
{
    $resolver = new OrmResolver();
    // 自动加载所有Policy，或手动指定
    $resolver->mapResource('Articles', 'App\Policy\ArticlePolicy');

    return new AuthorizationService([
        'policyFinder' => $resolver,
        // 若需在Policy中直接返回响应，开启此项（不推荐）
        // 'allowReturningResponse' => true,
    ]);
}

应急替代方案（不推荐） #

若不想用中间件，可在Policy中直接返回重定向响应，但违反单一职责原则：

// src/Policy/ArticlePolicy.php
use Cake\Http\Response;
use Cake\Routing\Router;
use Psr\Http\Message\ServerRequestInterface;

public function view(User $user, Article $article, ServerRequestInterface $request): Response|bool
{
    if ($user->id === $article->user_id) {
        return true;
    }
    return new Response()
        ->withStatus(302)
        ->withHeader('Location', Router::url('/login'));
}

需同时在授权服务配置中开启allowReturningResponse（见步骤4注释）。

内容的提问来源于stack exchange，提问作者shaan