Yii2 require all Controller and Action to login
Place this rule in the beginning of the rules section: [ ‘allow’ => true, ‘roles’ => [‘@’], ], Omitting the actions means all actions. So your AccessControl config will be like this: public function behaviors() { return [ ‘access’ => [ ‘class’ => AccessControl::className(), ‘rules’ => [ [ ‘allow’ => true, ‘roles’ => [‘@’], ], … Read more