How can I debug an "access denied" on almost every webform?

I checked every configuration section that I thought could affect access to webforms. Except for the sample content named Demo: Application (/node/371 in my context), every webform - the URL prefix is /form/ - can be accessed just by an administrator, that is a unprivileged user gets an Access denied answer (You are not authorized to access this page). This is driving me nuts. I cannot tell since when this problem is occurring. Before realizing there is such an issue the Drupal instance has been upgraded from an 8 to a 9 version and then from 9 to 10, and later the Nodeaccess module has been installed - but I did configure it properly to let people other than administrator to view and modify forms.

In a separate test instance I disabled the Nodeaccess module: the outcome didn't change, as far as accessing the webform is concerned. So what is going on? What may prevent any unprivileged authenticated user from accessing an arbitrary webform? How can I debug this?

Thanks in advance!

Andrea

The webform module alone has 11 places where it throws an access denied exception. There could be hundreds more in core, contrib or custom code.

To find it the easiest way would be a debugger stopping on exceptions.

If you don't have one you can throw a custom exception when any access denied exception is raised:

vendor/symfony/http-kernel/Exception/AccessDeniedHttpException.php

public function __construct(?string $message = '', \Throwable $previous = null, int $code = 0, array $headers = [])
{
    // add this line temporarily
    throw new \Exception("ACCESS DENIED: $message");
    parent::__construct(403, $message, $previous, $headers, $code);
}

Enable "All messages, with backtrace information" on /admin/config/development/logging and you will see a backtrace on the screen under your custom exception pointing at the place where the access is denied.

When you are finished with debugging don't forget to remove the added code line.

If you find AccessAwareRouter->checkAccess() in the backtrace it's a routing/permission issue. Then this topic might help Debug "Access Denied"