Why isn't my controller returning AccessResult::forbidden()?
There is a syntax error here Drupal::currentUser()-&gt;id() should be \Drupal::currentUser()-&gt;id() and also explode("/", $_SERVER["REQUEST_URI"])[2] gives you only people not the user id, to use User::load.