How do you specify an HTTP status code in Cakephp?

Question

In my controller, I check a condition to see if the user is allowed to do something. If the check fails, I want to send a 403 back to the browser. How do I do that in Cakephp?

Answer 1

EDIT - This question is quite old and covers different versions of the CakePHP framework. Following is a summary of which version each answer applies to. Don't forget to vote on the solution that helps most.

• CakePHP 3.x and 4.x - using response object (Roberto's answer)
• CakePHP 2.x - using exceptions (Brad Koch's answer) [preferred solution]
• CakePHP 2.x - setting header only (Asa Ayers' answer)
• CakePHP 1.x - using error handler (my other answer)
• CakePHP 1.x - setting header only (this answer)

EDIT #2 - A more detailed answer for CakePHP 2.x has been added by Mark37.

EDIT #3 - Added solution for CakePHP. (May 2018: CakePHP 3.5 did some function renaming, solution by Roberto is still valid.)

---

By looking at the relevant API code from the previous comment, it seems you can call Controller::header($status) to output a header without redirection. In your case, the proper usage is most likely:

$this->header('HTTP/1.1 403 Forbidden');

Answer 2

Notes concerning CakePHP 3.x seem to be missing, so to make this thread complete:

For CakePHP 3.x and 4.x use:

$response = $this->response->withStatus(403);
return $response;

For versions before CakePHP 3.3.x you can use the same style as CakePHP 2.x:

$this->response->statusCode('code');

Note that using the PHP function directly also works (http_response_code(403); die();), though using the response object seems like the intended method.

Answer 3

$this->response->statusCode(403);

Will set the status code when Cake is ready to send the response. CakeResponse::send() expects to send the status code and message, so in my tests I think my using header() was getting overwritten. using $this->header('HTTP/1.1 400 Bad Request') doesn't work either because Cake expects any call to $this->header to be split on a colon ex: $this->header('Location: ...')

Answer 4

In CakePHP 2, the preferred method is to throw an exception:

throw new ForbiddenException();

Answer 5

I'm adding in my two cents here because I don't feel like any of these answers covered this topic as thoroughly as I would have liked (at least for Cake 2.x).

If you want to throw an error status, use the Exception classes (as mentioned in other answers):

throw new BadRequestException(); // 400 Bad Request

// Or customize the code...
throw new BadRequestException('Custom error message', 405); // 405 Method Not Allowed

Fun fact: Cake will automatically do some magical error rendering even for RESTful calls via the ExceptionRenderer class. Even more fun of a fact is that it's based on the Status Code, not the fact that an Exception might have been thrown, so if you set the status code to > 400 on your own you will likely get error messages even if you didn't want them.

If you want to return a specific status code for a REST JSON/XML endpoint, take advantage of the new CakeResponse object, but also make sure that you add the special _serialize variable or you'll end up with a 'view not found' error as cake will attempt to find a view to render your JSON/XML. (This is by design - see the JsonView/XmlView class.)

$this->response->setStatus(201);  // 201 Created
$this->set('_serialize', array()); // Value must be something other than null

And lastly, if you want to send a non-200 status for a regularly rendered page, you can just use the setStatus() method with nothing else as mentioned in a previous answer:

$this->response->setStatus(201);

UPDATE:

$this->response->setStatus('code');

is no longer available. Use

$this->response->statusCode('code');

Answer 6

Upon revisiting this question, and reading Adriano's comment on my previous answer (regarding redirecting the user to a friendly page), I have come up with a new solution.

Within a controller you can call $this->cakeError('error404') to generate a friendly 404 page. This can can be customised (as with other errors) by creating file at 'app/views/errors/error404.ctp'.

After having a closer look at the code for cakeError, my recommendation is to try extending Cake's ErrorHandler by creating a file at 'app/error.php' or (possibly more preferable) 'app/app_error.php'.

The code for your error403 (mimicking the error404 code) could read as follows:

class AppError extends ErrorHandler {
    function error403($params) {
        extract($params, EXTR_OVERWRITE);
        $this->error(array(
            'code' => '403',
            'name' => 'Forbidden',
            'message' => sprintf(__("Access was forbidden to the requested address %s on this server.", true), $url, $message)));
            $this->_stop();
     }
}

You should also be able to provide a custom view for this error by creating 'app/views/errors/error403.ctp'. Here is a modified version of the error404 view:

<h2><?php echo $name; ?></h2>
<p class="error">
    <strong>Error: </strong>
    <?php echo sprintf(__("Access was forbidden to the requested address %s on this server.", true), "<strong>'{$message}'</strong>")?>
</p>

Answer 7

It has changed again since CakePHP 3.6:

Use now

    $this->setResponse($this->response->withStatus(403) );
    return $this->response; // use this line also 

instead of

    $response = $this->response->withStatus(403);

https://api.cakephp.org/3.7/class-Cake.Controller.Controller.html#_setResponse

Answer 8

Perhaps something in this section of the cakephp manual can help you.

redirect(string $url, integer $status, boolean $exit)

The flow control method you’ll use most often is redirect(). This method takes its first parameter in the form of a CakePHP-relative URL. When a user has successfully placed an order, you might wish to redirect them to a receipt screen. The second parameter of redirect() allows you to define an HTTP status code to accompany the redirect. You may want to use 301 (moved permanently) or 303 (see other), depending on the nature of the redirect.

The method will issue an exit() after the redirect unless you set the third parameter to false.

Answer 9

You can use cakephp response for custom message:

$this->response->header('HTTP/1.0 201', 'custom message');
$this->response->send();

Answer 10

Core PHP link code works in cakePHP.

header('HTTP/1.1 403 Forbidden');