<p dir="auto"><strong>Symfony version(s) affected</strong>: 4.1.0</p>
<p dir="auto"><strong>Description</strong><br>
Symfony 4.1.0 logs a request.CRITICAL whenever authentication is required.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[2018-06-14 20:52:10] security.INFO: Populated the TokenStorage with an anonymous Token. [] []
[2018-06-14 20:52:10] request.CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\AccessDeniedException: &quot;Access Denied.&quot; at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php line 68 {&quot;exception&quot;:&quot;[object] (Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException(code: 403): Access Denied. at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php:68)&quot;} []
[2018-06-14 20:52:10] security.DEBUG: Access denied, the user is not fully authenticated; redirecting to authentication entry point. {&quot;exception&quot;:&quot;[object] (Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException(code: 403): Access Denied. at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php:68)&quot;} []
[2018-06-14 20:52:10] security.DEBUG: Calling Authentication entry point. [] []"><pre class="notranslate"><code class="notranslate">[2018-06-14 20:52:10] security.INFO: Populated the TokenStorage with an anonymous Token. [] []
[2018-06-14 20:52:10] request.CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\AccessDeniedException: "Access Denied." at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php line 68 {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException(code: 403): Access Denied. at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php:68)"} []
[2018-06-14 20:52:10] security.DEBUG: Access denied, the user is not fully authenticated; redirecting to authentication entry point. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException(code: 403): Access Denied. at /Users/cjm/Sites/website-skeleton/vendor/symfony/security/Http/Firewall/AccessListener.php:68)"} []
[2018-06-14 20:52:10] security.DEBUG: Calling Authentication entry point. [] []
</code></pre></div>
<p dir="auto">This behavior is different than Symfony 3, which does not log the request.CRITICAL. It should be silenced because the exception is actually caught.</p>
<p dir="auto"><strong>How to reproduce</strong></p>
<ol dir="auto">
<li>Follow part 1-a on <a href="https://symfony.com/doc/current/security.html" rel="nofollow">https://symfony.com/doc/current/security.html</a> to configure basic authentication. Observe the log file when the /admin route receives a GET request.</li>
</ol>
<p dir="auto"><strong>Possible Solution</strong></p>

<p dir="auto"><strong>Additional context</strong></p>
<p dir="auto"><strong>Symfony version(s) affected</strong>: 4.1.0</p>
<p dir="auto"><strong>Description</strong></p>
<p dir="auto">Seems like ever since <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="279849633" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/25366" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/25366/hovercard" href="https://github.com/symfony/symfony/pull/25366">#25366</a>, authentication exceptions are first logged, and then handled gracefully (redirecting to a login entrypoint).</p>
<p dir="auto">If an unauthenticated user hits a route they cannot access (e.g. a homepage route with this firewall rule <code class="notranslate">- { path: ^/, role: ROLE_ADMIN }</code>), what currently happens is:</p>
<ul dir="auto">
<li>
<p dir="auto">step 1: <code class="notranslate">Symfony\Component\Security\Http\Firewall\AccessListener</code> rightfully throws an <code class="notranslate">AccessDeniedException</code> exception</p>
</li>
<li>
<p dir="auto">step 2: because of its new and high priority level (of <code class="notranslate">2048</code> since <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="279849633" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/25366" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/25366/hovercard" href="https://github.com/symfony/symfony/pull/25366">#25366</a>), <code class="notranslate">Symfony\Component\HttpKernel\EventListener\ExceptionListener</code> decides to log this exception: <code class="notranslate">Uncaught PHP Exception AccessDeniedException ...</code>. Logging such a CRITICAL error has the bad side-effect of causing Monolog to send me an email.</p>
</li>
<li>
<p dir="auto">step 3: because of its (now-comparatively-low) priority level of <code class="notranslate">1</code>, <code class="notranslate">Symfony\Component\Security\Http\Firewall\ExceptionListener</code> gets triggered. It converts the exception to a (redirect) <code class="notranslate">Response</code> (to the login page), and the website appears to work. However, it's way too late already, as "step 2" (above) already logged the error and sent me an exception email.</p>
</li>
</ul>
<p dir="auto"><strong>Possible Solution</strong></p>
<p dir="auto"><code class="notranslate">Symfony\Component\Security\Http\Firewall\ExceptionListener</code> can be executed with a higher priority than <code class="notranslate">Symfony\Component\HttpKernel\EventListener\ExceptionListener</code>, so that graceful handling of authentication exceptions can happen before logging.</p>
<p dir="auto">Changing <code class="notranslate">Symfony\Component\Security\Http\Firewall\ExceptionListener</code>, so that the <code class="notranslate">KernelEvents::EXCEPTION</code> priority is higher (from <code class="notranslate">1</code> to <code class="notranslate">2049</code>)  works around the problem.</p>