Well, in some cases, you can, but not always. A safe way to use it is {% if app.user is not null and is_granted() %} as app.user will return null when there is no token or when the user is anonymous

@stof I understand this (old) issue is down to the order of the listeners, but you say "in some cases you can" - in what cases would is_granted work?

@adamquaile when there is an error page that happend before initializing Security (in the referenced PR, there was an issue with the router, which is executed before the firewall, so it couldn't be used).

@wouterj Yeah, I get that. I'm wondering in what cases the firewall is executed before the routing exception..?

Well, in some cases, you can [use is_granted], but not always

I get why you can't, but why would it ever work? Would this only apply if we manually threw the not found exception from a controller?

By the way, with Symfony 2.8 you will be able to always use is_granted() without doing this check (see symfony/symfony#15953).

@adamquaile not all exceptions happen in the routing. The "in some cases" is about the other errors not happening in routing

@wouterj Okay. Got it, thanks.