PHPackages                             yidas/yii2-access-router - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Framework](/categories/framework)
4. /
5. yidas/yii2-access-router

ActiveYii2-extension[Framework](/categories/framework)

yidas/yii2-access-router
========================

Yii 2 user authentication & authorization router

1.0.1(7y ago)3103MITPHPPHP >=5.4.0

Since Jun 5Pushed 7y ago1 watchersCompare

[ Source](https://github.com/yidas/yii2-access-router)[ Packagist](https://packagist.org/packages/yidas/yii2-access-router)[ RSS](/packages/yidas-yii2-access-router/feed)WikiDiscussions master Synced 2mo ago

READMEChangelog (1)Dependencies (1)Versions (3)Used By (0)

 [ ![](https://avatars0.githubusercontent.com/u/993323) ](https://github.com/yiisoft)

Yii 2 Access Router
===================

[](#yii-2-access-router)

Yii 2 user authentication & authorization router

[![Latest Stable Version](https://camo.githubusercontent.com/13af5e053929d0d6e45d4861c9df7de613cba1aa4fffac9a43714c512110e95e/68747470733a2f2f706f7365722e707567782e6f72672f79696461732f796969322d6163636573732d726f757465722f762f737461626c653f666f726d61743d666c61742d737175617265)](https://packagist.org/packages/yidas/yii2-access-router)[![Latest Unstable Version](https://camo.githubusercontent.com/fdb7561e551728f1caa2add31a05e90e80c706c5f8e17da08611732e6d7d9ee8/68747470733a2f2f706f7365722e707567782e6f72672f79696461732f796969322d6163636573732d726f757465722f762f756e737461626c653f666f726d61743d666c61742d737175617265)](https://packagist.org/packages/yidas/yii2-access-router)[![License](https://camo.githubusercontent.com/cf089b870b7e122b12d9d864477957a4f1e74cd6bdf4f19a3fa4d498e2f7b948/68747470733a2f2f706f7365722e707567782e6f72672f79696461732f796969322d6163636573732d726f757465722f6c6963656e73653f666f726d61743d666c61742d737175617265)](https://packagist.org/packages/yidas/yii2-access-router)

FEATURES
--------

[](#features)

- *Yii 2 **User Authentication/Authorization for route level** Integration*
- ***RESTful API Authentication** by Access Token support*
- ***HTTP Request Login** by Access Token support*

Access Router is a simple user access filtered on route level which supports authentication and authorization. Different from Yii2 Access Control Filter (ACF), this User Authorization can specify routes but not only in controller-actions level.

---

OUTLINE
-------

[](#outline)

- [Requirements](#requirements)
- [Installation](#installation)
- [Configuration](#configuration)
    - [Options](#options)
- [Usage](#usage)
    - [Except](#except)
    - [HTTP Authentication](#http-authentication)
        - [Options](#options-1)
    - [Request Method Login](#request-method-login)
        - [Options](#options-2)
        - [POST Method without CSRF](#post-method-without-csrf)
- [Additions](#additions)
    - [ACF for Global](#acf-for-global)
- [References](#references)

---

REQUIREMENTS
------------

[](#requirements)

This library requires the following:

- PHP 5.4.0+
- Yii 2.0.0+

---

INSTALLATION
------------

[](#installation)

Install via Composer in your Yii2 project:

```
composer require yidas/yii2-access-router

```

---

CONFIGURATION
-------------

[](#configuration)

Setup a Access Router component and then add it into bootstrap for your application configuration:

```
return [
    'bootstrap' => ['log', 'access'],
    'components' => [
        'access' => [
            'class' => 'yidas\filters\AccessRouter',
            'except' => ['site/login', 'site/register'],
            'denyCallback' => function() {
                return Yii::$app->response->redirect(['/site/login']);
            },
        ],
        // ...
    ],
    // ...
];
```

1. Create a component called `access` which uses `yidas\filters\AccessRouter` as class with configuration.
2. Add this `access` component into `bootstrap` list.

### Options

[](#options)

KeyTypeDefaultDescription**except**array\['\*'\]Excepted routes for identity verification check. \['{controller}/{action}', '{d}/{c}/{a}'\]**denyCallback**callablenullDenyCallback for HTTP authentication[httpAuth](#http-authentication)arrayHTTP authentication framework feature[httpLogin](#request-method-login)arrayHTTP request method login featureexceptErrorActionbooleantrueError action would be excepted through filter while turning on---

USAGE
-----

[](#usage)

### Except

[](#except)

Access Router implements Access Control Filter (ACF) for routes that the user is must in login status to pass through the filter from any routes except specified ones.

You can setup excepted routes that skip the user authorization. The `except` setting with `[*]` value means that the user authorization is disabled:

```
'access' => [
    'class' => 'yidas\filters\AccessRouter',
    'except' => ['site/login'], //`site/login` is the login page which can not bypass user authorization
],
```

### HTTP Authentication

[](#http-authentication)

Access Router supports automatically authenticating client's request by HTTP Authentication with bearer schemes ([RFC 6750](https://tools.ietf.org/html/rfc6750)), you can enable it by setting up `httpAuth` configuration:

```
'access' => [
    'class' => 'yidas\filters\AccessRouter',
    'except' => ['site/login', 'site/register'],
    'httpAuth' => [
        'enable' => true,
        'denyCallback' => function() {
            $response = Yii::$app->response;
            $response->statusCode = 401;
            $response->format = \yii\web\Response::FORMAT_JSON;
            $response->data = ['message' => 'Access Denied'];
            return $response->send();
        },
    ],
],
```

> HTTP Authentication login will disable session for one time access uasge, which equals to `\Yii::$app->user->enableSession = false;`

#### Options

[](#options-1)

KeyTypeDefaultDescription**enable**booleanfalseEnable HTTP authentication**denyCallback**callablenullDenyCallback for HTTP authenticationforcedbooleantrueForce to authorize by HTTP authenticationkeystring'AUTHORIZATION'The header key### Request Method Login

[](#request-method-login)

Access Router also supports automatically login client's request by HTTP GET/POST parameter by giving access token, you can enable it by setting up `httpLogin` configuration:

```
'access' => [
    'class' => 'yidas\filters\AccessRouter',
    'except' => ['site/login', 'site/register'],
    'httpLogin' => [
        'enable' => true,
        'method' => 'post'
        'only' => ['site/login'],
        // 'key' => 'access_token',
    ],
],
```

For above configuration, you could login by accessing route `site/login` with correct `access_token` body value (*Content-Type: `application/x-www-form-urlencoded`*).

Request Method Login is same as form login that the session is enable, and the duration time could be customized.

For `GET` method, If you setup `'method' => 'get'` with `'only' => ['*']`, then you can login by any routes with correct `access_token` parameter. For example: `//example.com/?access_token={valid-user-access-token}`

> For security reasons, it's not recommended to use `GET` method that passes access token in parameter.

#### Options

[](#options-2)

KeyTypeDefaultDescription**enable**booleanfalseEnable HTTP request method login**method**string'post'Parameter's Methods of get/post**only**array\['\*'\]Allowed routes for login. \['{controller}/{action}', '{d}/{c}/{a}'\]durationinteger3600 \* 24 \* 30Seconds of login durationkeystring'access\_token'Parameter's keyforcedbooleantrueForce to authorize by HTTP authentication#### POST Method without CSRF

[](#post-method-without-csrf)

If you uses `post` method and want to disable global CSRF validatiob, you can set `enableCsrfValidation` to `false` for `request` configuration:

```
'components' => [
    'request' => [
        'csrfParam' => '_csrf-backend',
        'enableCsrfValidation' => false,
    ],
```

> If you just want to disable CSRF for some controllers/actions, dynamically setting `enableCsrfValidation` for controller.

---

ADDITIONS
---------

[](#additions)

### ACF for Global

[](#acf-for-global)

If you want to use original Yii 2 Access Control Filter (ACF) for global route instead of Access Router's User Authorization, just comment out the `except` of Access Router and add ACF rules into 'as beforeRequest' in config:

```
'bootstrap' => ['log', 'access'],
'components' => [
    'access' => [
        'class' => 'yidas\filters\AccessRouter',
        'except' => ['*'], // Equal to comment out
    ],
    // ...
],
'as beforeRequest' => [
    'class' => 'yii\filters\AccessControl',
    'rules' => [
        [
            'allow' => true,
            'actions' => ['login'],
        ],
        [
            'allow' => true,
            'roles' => ['@'],
        ],
    ],
    'denyCallback' => function () {
        return Yii::$app->response->redirect(['site/login']);
    },
],
```

**Warning:** ACF could only defines `actions` but not routes, which the actions could be applied by every controllers.

For above setting example, `login` excepted action could be matched by any controller such as `site/login`, `controller/login`.

---

REFERENCE
---------

[](#reference)

[Yii 2 - Application Structure > Application Events](https://www.yiiframework.com/doc/guide/2.0/en/structure-applications#application-events)

[RFC7617 - The 'Basic' HTTP Authentication Scheme](https://tools.ietf.org/html/rfc6750)

###  Health Score

28

—

LowBetter than 54% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity13

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity59

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~169 days

Total

2

Last Release

2728d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/b30d2b2c0b53aef65fad4af56cd3c7912d3db2b612890c706fe79448717f6aba?d=identicon)[yidas](/maintainers/yidas)

---

Top Contributors

[![yidas](https://avatars.githubusercontent.com/u/12604195?v=4)](https://github.com/yidas "yidas (4 commits)")

---

Tags

access-controlaccess-requestauthenticationauthorizationyii2yii2-extensionyii2-userframeworkAuthenticationaccessauthorizationyii2access-routeraccess-contorl

### Embed Badge

![Health badge](/badges/yidas-yii2-access-router/health.svg)

```
[![Health](https://phpackages.com/badges/yidas-yii2-access-router/health.svg)](https://phpackages.com/packages/yidas-yii2-access-router)
```

###  Alternatives

[skeeks/cms

SkeekS CMS — control panel and tools based on php framework Yii2

13825.6k47](/packages/skeeks-cms)[tecnocen/yii2-formgenerator

Yii 2 Library to configure form generator

145.7k](/packages/tecnocen-yii2-formgenerator)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)