I want a route to be accesed by everyone (logged in or not).

I removed the requirements and still I was seeing Access Denied.

It worked only when I put _access: 'TRUE'. Why is this mandatory? Should not default to public when no requirement is set?

  • You can just add the “access content” permission to the route. I would assume core does NOT assume access if not specified; it’s better to deny IMO instead of potentially leave a hole. – Kevin Oct 18 '18 at 3:16
  • I agree with Kevin. Access is denied by default and needs to be provided. As such, if no access rules are set, access is denied, since Drupal has no rules against which to check whether access should be provided. – Jaypan Oct 18 '18 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.