Yii2访问控制规则不会拒绝访客

Question

Here is code that I use for allowing authenticated users to do some actions

        'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

But this rules allow guests to enter create action. Afaik, by default guest users must be denied. What am I doing wrong?

Answer 1

Modify your code to:

 'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup', 'create', 'edit'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

Only array should contain List of action IDs that this filter should apply to.