Symfony $controller->getUser() alternative in non-secured areas? - security

Question

My current project almost all routes are protected by a form_login.
Two routes /login and /user/forgot_password should remain unprotected to be accessible by non-authenticated users.
Is there any way I can prevent access of authenticated users to this routes?
In my controller I can check for $this->getUser() however in non-secured areas the security.context is not filled with the corresponding data.
Configuration (security.yml):
security:
firewalls:
nonsecured:
pattern: ^/(login|user/forgot_password)$
security: false
secured:
pattern: ^/
# ...

Answer 1

You can't get the current user information without an active firewall. Here's how you can solve the problem:
Remove the nonsecured firewall so that the whole app is covered by an active firewall,
Enable anonymous access by adding anonymous: ~ to the secured firewall,
Use access control to decide who can get where:
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/forgot-password, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_USER }
To prevent access to /login and /user/forgot-password for authenticated users, you have at least these two options:
Check for the user in the controllers — the way you suggested, or
Use JMSSecurityExtraBundle's expressions:
access_control:
- { path: ^/login, access: 'isAnonymous()' }
- { path: ^/user/forgot-password, access: 'isAnonymous()' }
- { path: ^/, access: 'isAuthenticated()' }