[Security] Return 403 instead of 500 when no firewall is defined

Author: nicolas-grekas

Exception/AccessDeniedException.php

@@ -11,11 +11,14 @@
 
 namespace Symfony\Component\Security\Core\Exception;
 
+use Symfony\Component\HttpKernel\Attribute\WithHttpStatus;
+
 /**
  * AccessDeniedException is thrown when the account has not the required role.
  *
  * @author Fabien Potencier <[email protected]>
  */
+#[WithHttpStatus(403)]
 class AccessDeniedException extends RuntimeException
 {
     private array $attributes = [];

Exception/AuthenticationException.php

@@ -11,6 +11,7 @@
 
 namespace Symfony\Component\Security\Core\Exception;
 
+use Symfony\Component\HttpKernel\Attribute\WithHttpStatus;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 
 /**
@@ -19,6 +20,7 @@
  * @author Fabien Potencier <[email protected]>
  * @author Alexander <[email protected]>
  */
+#[WithHttpStatus(401)]
 class AuthenticationException extends RuntimeException
 {
     /** @internal */