Your Drupal node page says 403. Your RSS feed doesn't care
I ran into a bug where private content leaked even though a node access hook was already in place. Opening the node directly returned 403, exactly as intended. But the same content was sitting in the RSS feed, in search results and on taxonomy term pages, available to anyone. The hook wasn't broken. It checks permissions when someone visits the node page, and on those pages nobody was visiting…
A bug was encountered where private content was leaking through the RSS feed, despite a node access hook being in place. When the node was opened directly, a 403 error was returned, as intended. However, the same content was accessible via the RSS feed, search results and taxonomy term pages, available to anyone. The issue was not with the node access hook, but rather with Drupal's two separate access systems that do not communicate with each other.
This article demonstrates the difference between single-entity access and query access, and explains how to fix the issue using node grants.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
