Handling an Authorization Policy Violation

When an Authorization Policy is violated, the server, by default, will return the head status code. Alternatively, you can customize the 403 error page, render a page or redirect the user to a different page. On top of that, you can specify a flash alert message to display.

Prerequisites

To follow the steps in this tutorial, it is essential to have a deep understanding of the concept of Permissions. The guidelines presented here rely on the Authorization Policy created in an earlier tutorial.

• Permissions
• Adding an Authorization Policy

Steps

Handling a violated Authorization Policy is a two-step process:

• Step 1: Define a redirect or 403/404 page
• Step 2: Display the alert message

Step 1: Define a redirect or 403/404 page

Define whether you want to redirect the user to another page or display one of the 403 or 404 pages. To redirect the user to a page after violation, set the key. For example, to redirect to the  page:

---
name: only_allowed_by_johns
redirect_to: /login
---
...

If, instead, you would like to render a customized 404 page, set the to :

---
name: only_allowed_by_johns
http_status: 404
redirect_to: ""
---
...

The default behavior is equivalent to setting to .

Step 2: Display the alert message

To generate a flash alert message, use the property:

---
name: only_allowed_by_johns
redirect_to: /login
flash_alert: Please log in to access this page.
---
...

As with all flash messages, you can access it in Liquid using the variable.