In my custom module I have a few "publication" routes that do not need any kind of authentication. Months ago I learnt that I could achieve this with the following requirements in routing.yml:
my_module.myroute: [...] requirements: _access: 'TRUE'
This works on my existing routes.
Now I'm trying to add a new one that parses the
Authorization HTTP header only for identification purposes: the purpose is to show a custom view on public data, without any authentication or authorization need. So, I tried to reach my custom route adding an
Authorization header (via a browser extension), and I get the following error:
Path: /CLS/it/pub/quadroxml. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: The used authentication method is not allowed on this route. in Drupal\Core\EventSubscriber\AuthenticationSubscriber->onExceptionAccessDenied() (line 134 of [...]/core/lib/Drupal/Core/EventSubscriber/AuthenticationSubscriber.php).
So, sending an
Authorization header apparently triggers some authentication method even on routes with
Can I disable completely all authentication and authorization on some routes? Alternatively, can I enable the "used authentication method" on my route, and then accept any password? (I am only interested in the user id!)