php - Zend Framework 2 - ZFCUser - How to exclude landing page from auth -
i'm using zf2
in combination zfcuser
, bjyauthorize
. have landing page should globally accessable. other pages need behind login.
at first blamed bjyauthorize
not letting guest users access landing page. after discussions seems zfcuser
blocking way.
my question is: how can tell zfcuser not block 1 page/action?
edit:
my application/module.php
looks in this post. when add app myapp
whitlist, can access landing page other actions myapp
well.
any ideas how alter condition can match url or whitlist frontend-action?
maybe add second route landing page. that's not clean solution, right?
if insist on checking authentication in onboostrap method this:
class module { protected $whitelist = array( 'zfcuser/login' => array('login'), 'your-landing-route' => array('your-landing-action'), ); public function onbootstrap($e) { $app = $e->getapplication(); $em = $app->geteventmanager(); $sm = $app->getservicemanager(); $list = $this->whitelist; $auth = $sm->get('zfcuser_auth_service'); $em->attach(mvcevent::event_route, function($e) use ($list, $auth) { $match = $e->getroutematch(); // no route match, 404 if (!$match instanceof routematch) { return; } // route , action whitelisted $routename = $match->getmatchedroutename(); $action = $match->getparam("action"); if(array_key_exists($routename,$list) && in_array($action,$list[$routename])) { return; } // user authenticated if ($auth->hasidentity()) { return; } // redirect user login page, example $router = $e->getrouter(); $url = $router->assemble(array(), array( 'name' => 'zfcuser/login' )); $response = $e->getresponse(); $response->getheaders()->addheaderline('location', $url); $response->setstatuscode(302); return $response; }, -100); } }
i've changed code little white list contains specific actions. can check action parameter little bit more specific white listing.
i don't know if best way it, i'm showing how can it.
i don't think need check authentication when using bjyauthorize
can use resource checks. if user has other guest role real user , authenticated. again, i'm not 100% on know don't use zfcuser
authentication checks in application uses bjyauthorize
. use route guards specify role level needed aparticular route.
maybe else clarify this?
Comments
Post a Comment