# AccessControl

> AccessControl provides simple access control based on a set of rules.

[API reference](/docs/api/index.md) › [yii](/docs/api/yii/index.md) › [filters](/docs/api/yii/filters/index.md) › AccessControl

| class | `yii\filters\AccessControl` |
| --- | --- |
| Extends | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) » [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) » [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| Implements | [`yii\base\Configurable`](/docs/api/yii/base/configurable/index.md) |
| Since | 2.0 |
| Source | [`framework/filters/AccessControl.php`](https://github.com/yiisoft/yii2/blob/22.0/framework/filters/AccessControl.php#L61) |

AccessControl provides simple access control based on a set of rules.

AccessControl is an action filter. It will check its [`$rules`](/docs/api/yii/filters/accesscontrol/index.md#property-rules) to find
the first rule that matches the current context variables (such as user IP address, user role).
The matching rule will dictate whether to allow or deny the access to the requested controller
action. If no rule matches, the access will be denied.

To use AccessControl, declare it in the `behaviors()` method of your controller class.
For example, the following declarations will allow authenticated users to access the "create"
and "update" actions and deny all other users from accessing these two actions.

```
public function behaviors()
{
    return [
        'access' => [
            'class' => \yii\filters\AccessControl::class,
            'only' => ['create', 'update'],
            'rules' => [
                // deny all POST requests
                [
                    'allow' => false,
                    'verbs' => ['POST']
                ],
                // allow authenticated users
                [
                    'allow' => true,
                    'roles' => ['@'],
                ],
                // everything else is denied
            ],
        ],
    ];
}
```

## Properties

| Property | Type | Description | Defined by |
| --- | --- | --- | --- |
| [`$denyCallback`](#property-denyCallback) | `callable\|null` | A callback that will be called if the access should be denied to the current user. Default: `null`. | `AccessControl` |
| <span id="property-except"></span>[`$except`](/docs/api/yii/base/actionfilter/index.md#property-except) | `array` | List of action IDs that this filter should not apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-only"></span>[`$only`](/docs/api/yii/base/actionfilter/index.md#property-only) | `array` | List of action IDs that this filter should apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-owner"></span>[`$owner`](/docs/api/yii/base/behavior/index.md#property-owner) | `yii\base\T\|null` | The owner of this behavior Default: `null`. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| [`$ruleConfig`](#property-ruleConfig) | `array` | The default configuration of access rules. Default: `['class' => 'yii\filters\AccessRule']`. | `AccessControl` |
| [`$rules`](#property-rules) | `array` | A list of access rule objects or configuration arrays for creating the rule objects. Default: `[]`. | `AccessControl` |
| [`$user`](#property-user) | [`yii\web\User`](/docs/api/yii/web/user/index.md)`\|array\|string\|false` | The user object representing the authentication status or the ID of the user application component. Default: `'user'`. | `AccessControl` |

## Methods

| Method | Description | Defined by |
| --- | --- | --- |
| <span id="method-__construct"></span>[`__construct()`](/docs/api/yii/base/baseobject/index.md#method-__construct) | Constructor. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__call"></span>[`__call()`](/docs/api/yii/base/baseobject/index.md#method-__call) | Calls the named method which is not a class method. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__get"></span>[`__get()`](/docs/api/yii/base/baseobject/index.md#method-__get) | Returns the value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__isset"></span>[`__isset()`](/docs/api/yii/base/baseobject/index.md#method-__isset) | Checks if a property is set, i.e. defined and not null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__set"></span>[`__set()`](/docs/api/yii/base/baseobject/index.md#method-__set) | Sets value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__unset"></span>[`__unset()`](/docs/api/yii/base/baseobject/index.md#method-__unset) | Sets an object property to null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-afterAction"></span>[`afterAction()`](/docs/api/yii/base/actionfilter/index.md#method-afterAction) | This method is invoked right after an action is executed. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-afterFilter"></span>[`afterFilter()`](/docs/api/yii/base/actionfilter/index.md#method-afterFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-attach"></span>[`attach()`](/docs/api/yii/base/actionfilter/index.md#method-attach) | Attaches the behavior object to the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| [`beforeAction()`](#method-beforeAction) | This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action. | `AccessControl` |
| <span id="method-beforeFilter"></span>[`beforeFilter()`](/docs/api/yii/base/actionfilter/index.md#method-beforeFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-canGetProperty"></span>[`canGetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canGetProperty) | Returns a value indicating whether a property can be read. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-canSetProperty"></span>[`canSetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canSetProperty) | Returns a value indicating whether a property can be set. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-className"></span>[`className()`](/docs/api/yii/base/baseobject/index.md#method-className) static | Returns the fully qualified name of this class. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-detach"></span>[`detach()`](/docs/api/yii/base/actionfilter/index.md#method-detach) | Detaches the behavior object from the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-events"></span>[`events()`](/docs/api/yii/base/behavior/index.md#method-events) | Declares event handlers for the [`$owner`](/docs/api/yii/base/behavior/index.md#property-owner)'s events. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="method-hasMethod"></span>[`hasMethod()`](/docs/api/yii/base/baseobject/index.md#method-hasMethod) | Returns a value indicating whether a method is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-hasProperty"></span>[`hasProperty()`](/docs/api/yii/base/baseobject/index.md#method-hasProperty) | Returns a value indicating whether a property is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| [`init()`](#method-init) | Initializes the [`$rules`](/docs/api/yii/filters/accesscontrol/index.md#property-rules) array by instantiating rule objects from configurations. | `AccessControl` |
| [`denyAccess()`](#method-denyAccess) protected | Denies the access of the user. | `AccessControl` |
| <span id="method-getActionId"></span>[`getActionId()`](/docs/api/yii/base/actionfilter/index.md#method-getActionId) protected | Returns an action ID by converting [`Action::$uniqueId`](/docs/api/yii/base/action/index.md#property-uniqueId) into an ID relative to the module. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isActive"></span>[`isActive()`](/docs/api/yii/base/actionfilter/index.md#method-isActive) protected | Returns a value indicating whether the filter is active for the given action. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |

## Property details

### $denyCallback <span id="property-denyCallback"></span>

```php
public callable|null $denyCallback = null
```

A callback that will be called if the access should be denied to the current user.

This is the case when either no rule matches, or a rule with
[$allow](/docs/api/yii/filters/accessrule/index.md#property-allow) set to `false` matches.
If not set, [`denyAccess()`](/docs/api/yii/filters/accesscontrol/index.md#method-denyAccess) will be called.

The signature of the callback should be as follows:

```
function ($rule, $action)
```

where `$rule` is the rule that denies the user, and `$action` is the current [action](/docs/api/yii/base/action/index.md) object.
`$rule` can be `null` if access is denied because none of the rules matched.

### $ruleConfig <span id="property-ruleConfig"></span>

```php
public array $ruleConfig = ['class' => 'yii\filters\AccessRule']
```

The default configuration of access rules.

Individual rule configurations
specified via [`$rules`](/docs/api/yii/filters/accesscontrol/index.md#property-rules) will take precedence when the same property of the rule is configured.

### $rules <span id="property-rules"></span>

```php
public array $rules = []
```

A list of access rule objects or configuration arrays for creating the rule objects.

If a rule is specified via a configuration array, it will be merged with [`$ruleConfig`](/docs/api/yii/filters/accesscontrol/index.md#property-ruleConfig) first
before it is used for creating the rule object.

### $user <span id="property-user"></span>

```php
public yii\web\User|array|string|false $user = 'user'
```

The user object representing the authentication status or the ID of the user application component.

Starting from version 2.0.2, this can also be a configuration array for creating the object.
Starting from version 2.0.12, you can set it to `false` to explicitly switch this component support off for the filter.

## Method details

### beforeAction() <span id="method-beforeAction"></span>

```php
public function beforeAction(mixed $action): bool
```

This method is invoked right before an action is to be executed (after all possible filters.)
You may override this method to do last-minute preparation for the action.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$action` | `mixed` | The action to be executed. |

**Returns**

`bool`: Whether the action should continue to be executed.

### init() <span id="method-init"></span>

```php
public function init(): mixed
```

Initializes the [`$rules`](/docs/api/yii/filters/accesscontrol/index.md#property-rules) array by instantiating rule objects from configurations.

**Returns**

`mixed`

### denyAccess() <span id="method-denyAccess"></span>

```php
protected function denyAccess(yii\web\User|false $user): mixed
```

Denies the access of the user.

The default implementation will redirect the user to the login page if he is a guest;
if the user is already logged, a 403 HTTP exception will be thrown.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$user` | [`yii\web\User`](/docs/api/yii/web/user/index.md)`\|false` | The current user or boolean `false` in case of detached User component |

**Returns**

`mixed`

**Throws**

- [`yii\web\ForbiddenHttpException`](/docs/api/yii/web/forbiddenhttpexception/index.md): if the user is already logged in or in case of detached User component.