Yii2: Redirect loop when using role based access and IP restrictions

[peeter-tomberg]

public function behaviors()
    {
        return [
            'access' => [
                'class' => AccessControl::className(),
                'rules' => [
                    [
                        'actions' => ['logout', 'index'],
                        'allow' => true,
                        'ips' => \Yii::$app->params['secureIps'],
                        'roles' => ['@'],
                    ],
                    [
                        'allow' => true,
                        'actions' => ['login'],
                        'ips' => \Yii::$app->params['secureIps'],
                        'roles' => ['?'],
                    ],
                    [
                        'allow' => true,
                        'actions' => ['error']
                    ],
                ],
            ],
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'logout' => ['post'],
                ],
            ],
        ];
    }

When trying to access any URL I'm redirected to site/login and it continues to redirect to site/login instead of showing an error that I shouldn't be allowed to do any of that. Seems like the role check is executed before the ips check?

When the user is logged in but from a non secure IP I see a the right error view.

[mdmunir]

Try this

                    [
                        'allow' => true,
                        'actions' => ['login'],
                        'ips' => \Yii::$app->params['secureIps'],
                        'roles' => ['?'],
                        'danyCallback' => function(){
throw new ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
                        }
                    ],

[peeter-tomberg]

denyCallback is never called.

[samdark]

Fixed. Now you'll get 403 instead of redirect loop in this case.

[samdark]

Please use forums for questions. GitHub is for bug requests. Thanks!