Restrict or redirect logged in users from login page

Question

I am using Symfony 2.7, installed FOSuserbundle, everything is working fine. My users are being created and I can login with them, but logged in users can enter the log in page, which doesn't seem logic to me. I've looked a bit for answers and found out I have to configure my security.yml file, but it still doesn't work, anyone can enter the login page.

I found that I have to set

 - { path: ^/, role: ROLE_USER}

but that gives me a redirect loop.

Here is what I have in it

    firewalls:
    # disables authentication for assets and the profiler, adapt it according to your needs
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    main:
        pattern: ^/
        form_login:
            provider: fos_userbundle
            csrf_provider: security.csrf.token_manager # Use form.csrf_provider instead for Symfony <2.4

        logout:       true
        anonymous:    true
        # activate different ways to authenticate

        # http_basic: ~
        # http://symfony.com/doc/current/book/security.html#a-configuring-how-your-users-will-authenticate

        # form_login: ~
        # http://symfony.com/doc/current/cookbook/security/form_login_setup.html
access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/profile, role: ROLE_USER }
    - { path: ^/admin/, role: ROLE_ADMIN }

Abdelaziz Dabebi · Accepted Answer · 2015-08-21T08:12:46.880

1

Override the loginAction of tge SecurityController, this way:

class SecurityController extends BaseSecurityController
{
public function loginAction(Request $request)
{
   if( $this->container->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY') { 
   return $this->redirect($this->generateUrl('any_route_you_want'))
}

  return parent::loginAction($request);
 }
}

Edit : To learn how to override any part of a Bundle, this would be helpful

edited Aug 21 '15 at 08:12

answered Aug 21 '15 at 08:05

Abdelaziz Dabebi

1,624
1
16
21

Still doesn't work, I get the 'This webpage has a redirect loop' again. – George Irimiciuc Aug 21 '15 at 08:11
to which route are you redirecting an already logged in user?! – Abdelaziz Dabebi Aug 21 '15 at 08:15
SecurityController does return $this->renderLogin(array( 'last_username' => $lastUsername, 'error' => $error, 'csrf_token' => $csrfToken, )); and I am doing return $this->redirect($this->generateUrl('main_page')) in my overridden class, which is the '/' route – George Irimiciuc Aug 21 '15 at 08:20
Ok, apparently it worked. For some reason Chrome was giving me the loop, but in Firefox everything worked just fine. The problem is, what if I want to restrict more pages from logged in users? Do I have to redirect them to the main page in each controller? What about restricting users that are not logged in from certain pages? – George Irimiciuc Aug 21 '15 at 08:35
First, accept my answer,. Second, you have to start another thread and post you question to keep the site well organized. – Abdelaziz Dabebi Aug 21 '15 at 09:48
Ok, thank you. Here is the question http://stackoverflow.com/questions/32137405/restrict-users-from-multiple-pages – George Irimiciuc Aug 21 '15 at 09:52

score 0 · Answer 2 · edited Jun 20 '20 at 09:12

Allready tryed this Solution ? FOSUserBundle redirect from login page after logged in

PHP:

You can override FOSUserBundle\Controller\SecurityController and add the following code at the top of loginAction.

use Symfony\Component\HttpFoundation\RedirectResponse;
// ...
public function loginAction(Request $request)
{
$securityContext = $this->container->get('security.context');
$router = $this->container->get('router');
if ($securityContext->isGranted('ROLE_ADMIN')) {
    return new RedirectResponse($router->generate('admin_home'), 307);
}
if ($securityContext->isGranted('ROLE_USER')) {
    return new RedirectResponse($router->generate('user_home'), 307);
}
// ...

yaml:

The easier solution is to add these two lines to your app/config/security.yml:

always_use_default_target_path & default_target_path, e.g.:

firewalls:
    main:
        pattern: ^/
        form_login:
            provider: fos_userbundle
            csrf_provider: form.csrf_provider
            login_path: /login
            check_path: /login_check
            always_use_default_target_path: false
            default_target_path:            /your/start/path/

Still getting a redirect loop. It also seems to be quite old for 2.4 version. — George Irimiciuc, Aug 21 '15 at 08:26

Restrict or redirect logged in users from login page

2 Answers2

Linked