0

I would like to have the whole page access enabled only if user logged in (except the FOS user login page)

This is how I set the access control:

access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, role: ROLE_ADMIN }

But the problem is as it now blocks all my scripts. CSS and JS are not available, so login page is not styled! If I remove:

- { path: ^/, role: ROLE_ADMIN }

From the access control everything is OK and the login page is styled. Any help on how to put the whole page under "lockdown" (except the login page) but still have the styles displayed (CSS)?

J.T.
  • 135
  • 11
  • where is the css located and how have you implemented it? Normally it should just work like that. CSS is supposed to be inside the /web folder, which is not affected by routing or security. – Koalabaerchen Nov 06 '14 at 12:01
  • In my bundle implemented through base.html.twig in stylesheets. Then symlink on web/bundles (on my localhost dev environment). – J.T. Nov 06 '14 at 12:03
  • by symlink you mean that you have the actual files in web/bundles and have a symbolic link inside the bundle resources that links to those and you call the symbolic links? – Koalabaerchen Nov 06 '14 at 12:07
  • No I have my files inside Bundle/Resources/public/css and js. And then I created symbolic links in the web with: php app/console assets:install --symlink – J.T. Nov 06 '14 at 12:12
  • Does it just not load the assets (not inside the DOM) or does it throw errors like 404 or 403 (in your browser network tab). Can you also post your role hierarchy? – Koalabaerchen Nov 06 '14 at 12:24
  • No errors, just unstyled page. The links to the files are inside the head but the files appear to be empty, no code in them. I have only one role: ROLE_ADMIN: ROLE_ADMIN – J.T. Nov 06 '14 at 12:29
  • Are they visible if you login? – qooplmao Nov 06 '14 at 13:11
  • I opened index so all users can access it and did a redirect there based on user login status. Done like so all the resources files load OK. – J.T. Nov 06 '14 at 13:12
  • @Qoop yes they are visible if i login. – J.T. Nov 06 '14 at 13:12
  • 1
    How about if you add those directories to the top of your access_control like `- { path: ^/css, role: IS_AUTHENTICATED_ANONYMOUSLY }`. Does that get it working? – qooplmao Nov 06 '14 at 13:22
  • @Qoop doing that for js, css, and bundles does the trick! Please post as an answer so I can mark as correct answer and upvote. Thnx. – J.T. Nov 07 '14 at 07:17

1 Answers1

1

The paths to your js, css and bundles directories are being caught by your access control that is stating that the user must be ROLE_ADMIN. To sort this you can just add rules for these directories above the ^/ rule using IS_AUTHENTICATED_ANONYMOUSLY like..

access_control:
    - { path: ^/css, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/js, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/bundles, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, role: ROLE_ADMIN }
qooplmao
  • 17,622
  • 2
  • 44
  • 69