Hi all, has anyone already did a redirect, whenever the user is not logged in? We want to "close" ou

ULL0N440J

Hi all,
has anyone already did a redirect, whenever the user is not logged in? We want to "close" our shop completely (more than hiding prices etc.) so the user has to pass the /login first.
Thanks in advance 🙂

UKTSRTD5M

yes, we did something like this (but only for some pages, like for example the shopping cart). But i guess it could easily be extended to more pages

ULL0N440J

How did you do it? All I've seen so far is the is_granted('ROLE_USER') directly in the template

UKTSRTD5M

i've not been involved, so i would have to ask for details, but we are using CustomerAccessPermissionConfig

UKTSRTD5M

via CustomerAccessPermissionClient

ULL0N440J

Great, I'll have a look at it 🙂 Thanks!

UKTSRTD5M

we've implemented a custom CustomerSecurityServiceProvider which overrides setSecurityAccessRules

giovanni.piemontese

We did this... u have to define only the config customer secured and anonymous pattern right..

$config[CustomerConstants::CUSTOMER_SECURED_PATTERN]
$config[CustomerConstants::CUSTOMER_ANONYMOUS_PATTERN]

ULL0N440J

Well 😄 Surprisingly easy. Totally forgot about having a look into the config at all ?$config[CustomerConstants::CUSTOMER_SECURED_PATTERN] = '^((?!\/login).)*$';

ULL0N440J

Thank you both 🙂

UKHD8KTMF

if you want to really close it you can change the security provider to reverse the logic

UKHD8KTMF

on our project we have explicit white list for pages that we want to open

UKHD8KTMF

because the requirement was to have everything locked

UKHD8KTMF

with blacklisting there is a great chance that you will open something by mistake

ULL0N440J

@UKHD8KTMF I've extended the regex and added my cms-pages (like imprint, terms of agreement etc. should be available, even if not logged in). Luckily We don't have that much pages we need to open to the world.

Out of interest: How do you manage your whitelist?

UKHD8KTMF

Hi Daniel, on my project we have modified the CustomerSecurityProvider or CustomerSecurityServiceProvider as it is now called. Basically we changed the order $app['security.access_rules'] and that reverted the logic.