Question

I have weird problem. I can’t close access for pages

/registration
/login
/resetting

for already authorized users.

access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/profile, role: ROLE_USER }
    - { path: ^/admin/, role: ROLE_ADMIN }

Why is user with rule ROLE_USER have access to page /login ? And how should I close it ?
Using templates or security.xml ?

How can I redirect users with rule ROLE_USER when want to access /login ?

Answer 1

Roles are hierarchically determined in Symfony2 ; ROLE_USER is obviously in top of IS_AUTHENTICATED_ANONYMOUSLY, that’s why your users can access any pages that can be accessed for anonymous people.

If you want to restrain access, you need to check in your controller if the user is authenticated, and redirected him in this case.