I have setup custom error pages to display for certain HTTP errors in the folder:
app/Resources/TwigBundle/views/Exception/
The 403 page (<
I would suggest checking for app.security.token to be more strict and evaluate to true even when user is anonymous.
If you check for app.user it will evaluate false in Exception templates, but even when the firewall is present (= regular templates) but the user is not logged. This will prevent - for example - the display of a login button.
See: https://github.com/symfony/symfony-docs/pull/2359