Exclude public pages from access control list

Question

I have application in Symfony2 with 2 roles: ROLE_ADMIN and ROLE_PARTNER. Also I have some public pages. All public pages starts with URL "/public/". I want to protect all application excluded these public items.

My current config:

access_control:
    - { path: /.*, role: ROLE_PARTNER|ROLE_ADMIN }
    - { path: /public/.*, role: IS_AUTHENTICATED_ANONYMOUSLY }

But it works wrong (looping redirection).

Prolate

Answer 1

Change the order:

access_control:
    - { path: ^/public/, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, role: ROLE_PARTNER|ROLE_ADMIN }

The second option is to turn off security for the public section completely:

firewalls:
    public:
        pattern: ^/public/
        security: false

Dasya

You helped me with help of @Carlos Granados – Prolate

This solution is probably the clearest. One thing to keep in mind though; In my situation the secured area was ^/ and I had to exclude ^/api. I had to list the ^/api definition "before" the overall ^/ definition to make it work. – Dong

Answer 2

Add:

- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }

See "Common Pitfalls" in http://symfony.com/doc/current/book/security.html#using-a-traditional-login-form

Starofbethlehem

You helped me with help of @elnur – Prolate