TL;DR:: If there's no desire to use clear limitations in a couple-third of the excitement, you can look at it. http://symfony.com/doc/current/expressions.html#security-expression-variables or implement http://symfony.com/doc/current/security/voters.html with the right logic.Why didn't the set of rules set out on the question?We'll see a very simplified access-control scheme.Each request shall be compared with the list of access rules access_control♪ If a request can be compared with one of the rules, the restrictions described in this rule will be applied to the request, and further processing of the list shall cease (first win).If the result of the previous step verification is not satisfactory (no role required, not the type of request, IP restrictions, etc.), an internal exception shall be made AccessDeniedException♪Exceptions AccessDeniedException The system will attempt to authenticate the user by redirecting the user login_pathif the user has not yet completed the entrance or return the HTTP error with code 403 if the user is collateral but not authorised to use the resource.IS_AUTHENTICATED_ANONYMOUSLY ♪ This attribute has users who have entered the firewall area but who have not yet completed the logic. Frequently used to guarantee access to resources.IS_AUTHENTICATED_FULLY ♪ Such attributes are available to users who provided data for authentication during the current session. This attribute includes the previous one.There is another between the two attributes described: IS_AUTHENTICATED_REMEMBEREDbut we're not gonna focus on him.Now let's look at your first configuration:access_control:
- { path: /signup/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: /login/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
Access to resources /signup/ and /login/ for all users is guaranteed. It doesn't work as you expect, but it works as described in the documentation: any user can get on the logic and registration page.Then you change access attributes: access_control:
- { path: /signup/, roles: IS_AUTHENTICATED_ANONYMOUSLY && !IS_AUTHENTICATED_FULLY }
- { path: /login/, roles: IS_AUTHENTICATED_ANONYMOUSLY && !IS_AUTHENTICATED_FULLY }
Thus, as an anonymous user is considered to be authorised anonymously (when and with the lowest level of access), a controversial condition is obtained: the user of the authenticated and the user is not authenticated (IS_AUTHENTICATED_FULLY includes IS_AUTHENTICATED_ANONYMOUSLY). For the reasons described above, a cyclical recirculation will be obtained: for login and registration, the user will always be considered unauthorised (regardless of the actual context) and an attempt will be made to re-adjust the same /login/.Then you add to the counteraller:if ($this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_FULLY')) {
throw $this->createAccessDeniedException();
}
This time, the audit takes place in the context of the authenticated user and is expected to work.