安全防火墙仍然要求登录访问

Question

I have a controller where I check, trough AJAX call from view and executing the logic on the controller, if some values exists or not at database. Because I'm using FOSUserBundle I have added this line to the controller: use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security then in each method of the controller I added this annotation:

/**
 * @Route("/check/{value}", name="check")
 * @Method("GET")
 * @Security("has_role('IS_AUTHENTICATED_ANONYMOUSLY')")
 */
public function checkExistsAction($value = null) {
   // some logic goes here  
}

That doesn't work since I get login form as result and not the JSON I made inside the function, I already try by adding directly the route to the security.yml as follow:

access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/check, role: IS_AUTHENTICATED_ANONYMOUSLY }    
    - { path: ^/, role: ROLE_USER }
    - { path: ^/admin/, role: ROLE_ADMIN }

But that doesn't work either. Any advice? What I'm doing wrong here?

PS: I notice something curious on Netbeans IDE (maybe is one of that crazy things of NB) and is that Security isn't recognized as a annotation, see picture below and notice the Security line with some warning:

Some others unsuccessful tests

First test: Since I'm using JMSSecurityExtraBundle also I have added this line to my controller: use JMS\SecurityExtraBundle\Annotation\Secure; then I made some changes at my code:

/**
 * @Route("/check/{value}", name="check")
 * @Method("GET")
 * @Secure(roles="IS_AUTHENTICATED_ANONYMOUSLY")
 */
public function checkExistsAction($value = null) {
   // some logic goes here  
}

Result: Didn't work.

Second test: I disable the security at access_control as follow:

access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/admin/, role: ROLE_ADMIN }

Then clear the cache.

Result: Didn't work.

I don't know what else to do in order to get this working. This is the firewall definition at security.yml file:

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false
    main:
        pattern: ^/
        form_login:
            provider: fos_userbundle
            csrf_provider: form.csrf_provider
        logout:
             path: fos_user_security_logout
             target: /
             invalidate_session: false
        anonymous: ~

Any advice or ideas? I'm out of them and getting crazy with this.

Correction

With second test, after changes framework-extra-bundle from stable to dev things start working but this is not right since I'm leaving my application without any security so I need another path or solution

Answer 1

Are you sure you are properly authenticated? Make sure your http request is sending the cookie: 'PHPSESSID=svhag4u4fkj0em722eo5cd1pm4' header. (shouldn't have exactly that value). If thats true, then make sure that the user is actually being authenticated. You can do this by removing your security annotation and checking what the value of

$this->container->get('security.context')->getToken()->getUser();
//This only works in the controller

using var_dump or by debugging it. If that value is null that means your user provider isn't actually loading the user, and you either aren't authenticated or have a configuration issue.

Edit:

I just noticed the issue.

IS_AUTHENTICATED_ANONYMOUSLY will return true if the user is not logged in. So if you have logged in this will actually prevent you from viewing any of those routes.