symfony - IS_AUTHENTICATED_ANONYMOUSLY not working

Question

I'm starting with journey with Symfony.
At this I trying to secure my auth routes (I'm using FOSUserBundle) so I do:

access_control:
    - { path: ^/logowanie$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/rejestracja, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetowanie-hasla, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/backstage/, role: ROLE_ADMIN }
    - { path: ^/profile/, role: ROLE_USER }

However, I can always go to these routes whether I'm logged in or not.
Where is my bad?

# To get started with security, check out the documentation:
# https://symfony.com/doc/current/security.html
security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    providers:
        fos_userbundle:
            id: fos_user.user_provider.username

    firewalls:
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_token_generator: security.csrf.token_manager
                check_path: fos_user_security_check
                login_path: fos_user_security_login
            logout:
                path: fos_user_security_logout
                target: website.home
            logout:       true
            anonymous:    true

    access_control:
        - { path: ^/logowanie$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/rejestracja, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetowanie-hasla, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/backstage/, role: ROLE_ADMIN }
        - { path: ^/profile/, role: ROLE_USER }

Ow

show full security config – Weeks

It is not really clear from your question, but I guess, in your case, any user can go to /backstage/ and /profile/? – Mckie

@MaxP. added into question. Jovan Perovic Not only. I want to prevent access for logged user to this routes (logowanie - login, rejestracja - register, etc.) – Ow

No you can't do this that way. If user is logged in also have role IS_AUTHENTICATED_ANONYMOUSLY. This is how role hierarchy work (otherwise there is no reason called it "hierarchy"). – Gangplank

@Gangplank So what's the best solution? Override view methods for this routes with added condition for logged user? – Ow

- { path: ^/logowanie$, role: IS_AUTHENTICATED_ANONYMOUSLY && !IS_AUTHENTICADED_FULLY } – Gangplank

In case someone runs into this issue in >2023: Use the PUBLIC_ACCESS role in more recent symfony versions. – Vieira

Answer 1

You should restrict access to logged-in users, now if a user is logged in, also has the role IS_AUTHENTICATED_ANONYMOUSLY, this is role hierarchy.

- { path: ^/logowanie$, role: IS_AUTHENTICATED_ANONYMOUSLY && !IS_AUTHENTICATED_FULLY }                

Gangplank

There is not any mention, in the documentation, about using logical operators in access_control -> role attribute. Is it working in any version of Symfony? – Commence

I think that this is a part of Symfony expresion language. – Gangplank

thats something you can only write in the allow_if symfony.com/doc/current/security/… – Pinafore

Answer 2

You can use PUBLIC_ACCESS instead off IS_AUTHENTICATED_ANONYMOUSLY

access_control:
      - { path: ^/logowanie$, roles: PUBLIC_ACCESS }

best regards ;)

Lorri

Ref github.com/symfony/symfony/pull/42510/files – Alvinalvina