Yii2控制器认证异常：POST/GET请求被强制重定向至登录页求助

Hey there! Let's break down why your guest POST/GET requests are getting redirected to the login page when using dektrium/yii2-user—here are the most common causes and fixes to try:

The first place to look is your controller's behaviors() method. Yii2's AccessControl component might be forcing authentication for your target actions without you realizing it.

Make sure your action is explicitly allowed for guest users (denoted by ?), not logged-in users only (denoted by @):

use yii\filters\AccessControl;

public function behaviors()
{
    return array_merge(parent::behaviors(), [
        'access' => [
            'class' => AccessControl::class,
            'rules' => [
                [
                    'actions' => ['your-post-action', 'your-public-get-action'],
                    'allow' => true,
                    'roles' => ['?'], // This grants access to guests
                    // Avoid 'roles' => ['@'] here—that's for logged-in users only
                ],
                // Other rules...
            ],
        ],
    ]);
}

Also, if your controller inherits from a parent controller (like a base app controller or a Dektrium-provided controller), double-check that the parent's access rules aren't overriding your custom ones.

Head to your config/web.php file and check the user module configuration. Sometimes global access rules are applied to the entire module, which might accidentally affect your custom controllers:

'modules' => [
    'user' => [
        'class' => dektrium\user\Module::class,
        // Make sure you don't have a global access rule like this (unless intentional):
        // 'as access' => [
        //     'class' => AccessControl::class,
        //     'rules' => [
        //         ['allow' => true, 'roles' => ['@']],
        //     ],
        // ],
    ],
],

If your custom controller is part of the Dektrium module, ensure its actions aren't covered by the module's default protected routes.

If Postman POST requests are getting redirected, CSRF validation failure is a likely culprit. Yii2 enables CSRF protection by default for all POST requests—even for guests.

Here are two ways to handle this:

• For Postman testing: First send a GET request to any page on your app, grab the _csrf cookie from the response, then add it to your POST request:
  • Either as a header: X-CSRF-Token: [your-csrf-token-value]
  • Or as a form parameter: _csrf=[your-csrf-token-value]
• For public actions/APIs: If the action doesn't need CSRF protection (e.g., a public API endpoint), disable it for that specific action:

  public function behaviors()
  {
      $behaviors = parent::behaviors();
      $behaviors['csrfFilter'] = [
          'class' => \yii\web\CsrfFilter::class,
          'except' => ['your-post-action'], // Skip CSRF for this action
      ];
      return $behaviors;
  }
  

  Note: Only disable CSRF if you're sure the action doesn't need protection against cross-site request forgery.

Verify your urlManager configuration in config/web.php to make sure your request isn't being incorrectly routed to a Dektrium action that requires authentication. For example, if your action's URL matches a protected Dektrium route (like user/login), the module's access rules will kick in.

Sometimes Postman retains old login cookies from previous tests, which can cause unexpected redirects even when you intend to send a guest request. Clear the cookies for your app's domain in Postman and try again.

Start with the access control rules first—they're the most common culprit. Work through each step, and you should be able to get your guest requests working as expected!

内容的提问来源于stack exchange，提问作者Андрій Петровський