I am attempting to create a custom module that redirects anonymous/unauthenticated users away from the site. This site is only supposed to be used by admins, so in order to access it, they must type /user/login at the end of the url to be taken to a log in page.

I have my mymodule.info.yml file created as well as my mymodule.module file.

Then in mymodule.services.yml file I have:

    class: Drupal\redirect_unauthenticated_user\EventSubscriber\RedirectAnonymousSubscriber
      - {name: event_subscriber}

In my /src/EventSubscriber folder I have a RedirectAnonymousSubscriber.php file:


namespace Drupal\hid_redirect_unauthenticated_user\EventSubscriber;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

 * Event subscriber subscribing to KernelEvents::REQUEST.
class RedirectAnonymousSubscriber implements EventSubscriberInterface {
  public function checkAuthStatus() {

    if (\Drupal::currentUser()->isAnonymous() && \Drupal::routeMatch()->getRouteName() !== 'user/login') {

      $response = new RedirectResponse('google.com', 301);

  public static function getSubscribedEvents() {
    $events[KernelEvents::REQUEST][] = array('checkAuthStatus');
    return $events;

Here, I am trying to check if the user is anonymous/unauthenticated and are not on the user/login page, redirect them to an external url (google.com for example here).

Finally, I have a mymodule.routing.yml file (which I'm not even sure if I need):

  path: '/hid_redirect_unauthenticated_user'
    _controller: '\Drupal\hid_redirect_unauthenticated_user\EventSubscriber\RedirectAnonymousSubscriber::getSubscribedEvents'
    _access: 'TRUE'

Currently my site redirects even when I type /user/login at the end of my url. I apologize if this is all over the place but I've been playing with it for a while and feel like I'm confusing myself. Any help appreciated. Thanks!

2 Answers 2


I know this question is old, and I might not help the OP, but I will leave a solution here for future reference.

The status code needs to be 302 instead of 301 since 301 is meant for permanent redirects which will cause bugs on your site. (meaning no matter what conditions and "if statements" you have, it will redirect. Even if you are logged in). You can read more about HTTP status codes here.

So you change this code: $response = new RedirectResponse('google.com', 301);

to this: $response = new RedirectResponse('google.com', 302); and everything should be good.


Your route name is incorrect. You are making a comparison of the path, rather than the route name:

\Drupal::routeMatch()->getRouteName() !== 'user/login'

The route name of the user login page is user.login, so you should use that:

\Drupal::routeMatch()->getRouteName() !== 'user.login'
  • I had it like that before and didn't change anything. Thanks though! Jan 29, 2020 at 22:46
  • You need to clear the registry after making any changes like this, as responses will be cached. You may need to clear your browser cache as well, as browsers sometimes cache redirects.
    – Jaypan
    Jan 30, 2020 at 1:00
  • Clear the registry? Is that a Drupal thing or could you point me where to find it? I've never heard of it. Jan 30, 2020 at 15:11
  • It’s a Drupal thing. Admin -> Configuration -> Development -> Performance.
    – Jaypan
    Jan 30, 2020 at 15:12
  • For some reason I messed up my redirection so bad I can even get onto my Drupal site.. it redirects me even when I type in /user/login. Is there a command line way to clear the registry? Jan 30, 2020 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.