Matthew Radcliffe
--- a/core/modules/contact/tests/src/Functional/Hal/MessageHalJsonAnonTest.php
+++ b/core/modules/contact/tests/src/Functional/Hal/MessageHalJsonAnonTest.php
    ];
  }

+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedUnauthorizedAccessMessage($method) {
+    if ($method === 'POST') {
+      return "Message entities are not stored.";
+    }
+    return parent::getExpectedUnauthorizedAccessMessage($method);
+  }
+
+  /**
+   * Overrinding from EntityResourceTestBase base class.
--- a/core/modules/contact/tests/src/Kernel/MessageEntityTest.php
+++ b/core/modules/contact/tests/src/Kernel/MessageEntityTest.php
    $admin = $this->createUser(['uid' => 4], ['administer contact forms']);

    $this->assertFalse(\Drupal::entityTypeManager()->getAccessControlHandler('contact_message')->createAccess(NULL, $no_access_user));
-    $this->assertTrue(\Drupal::entityTypeManager()->getAccessControlHandler('contact_message')->createAccess(NULL, $access_user));
+    // Issue 2878513 - asserting false as always rejects requests.
-    // Issue 2878513 - asserting false as always rejects requests.
+    // Create access is denied at the access-handler level as messages aren't stored.
--- a/core/modules/contact/tests/src/Functional/Rest/MessageResourceTestBase.php
+++ b/core/modules/contact/tests/src/Functional/Rest/MessageResourceTestBase.php
+
+    $request_options[RequestOptions::BODY] = $unparseable_request_body;
+
+    // DX: 403 when unparseable request body.
+    $response = $this->request('POST', $url, $request_options);
+    $this->assertResourceErrorResponse(403, $forbiddenAccessMessage, $response);
+
+    $request_options[RequestOptions::HEADERS]['Content-Type'] = static::$mimeType;
+
+    // 403 for well-formed request. Would normally return 200 for well formed
+    // request, but request forbidden so returns 403.
+    $response = $this->request('POST', $url, $request_options);
+    $this->assertResourceErrorResponse(403, $forbiddenAccessMessage, $response);
+
+    // Would normally check for correct response, but all responses forbidden,
+    // so nothing more to do.