User login link is always visible in menu

Question

I have created user login link in the user account menu but the link is visible all the time(even for logged users). The user profile menu link and the user logout links are displayed properly(they are added by the user module).

My link definition doesn't differ from the user's module link definitions in any way but still this happens. Also the user.login route has proper requirements so this should just not happen but it does.

This is how user module defines menu links:

user.page:
  title: 'My account'
  weight: -10
  route_name: user.page
  menu_name: account
user.logout:
  title: 'Log out'
  route_name: user.logout
  weight: 10
  menu_name: account

This is how I define my login link:

user.login:
  title: 'Log in'
  weight: -10
  route_name: user.login
  menu_name: account

Answer 1

This seems to be a bug, /user/login should not be accessible as an authenticated user, but it redirects to user/1.

Edit: Discussed this with @dawehner and we figured it out together. This is egression: Do not bypass route access with 'link to any page' permissions for menu links

Open a bug report. This might actually a be a pretty serious security issue, looking at AccessManager, I don't understand why that starts with an allowed() state,LoginStatusCheck returns neutral, that is merged together to an allowed().