Very basic web security

I'm having a problem with simple web security. I create a user group, I create a resource group, login works great, but the supposedly secured resources aren't hidden. I'm obviously missing a critical step in the process somewhere.

Have you also create a user group and added the resource group to that user group?

Edit: ops just re read and see you've created the user group, but have you linked them together.

You must make sure that the anonymous user has no permissions on the Resource Group, as well.

Yes, indeed. Both using the "wizard" and manually.

I like my code, but I only have one type of user.... so its not a big deal for me.

Did you try this tutorial? Its a pretty good starter-pack on MODx security.

And when you saying hidden do you mean you can still view the page or something like getResource is still pulling them in? As recall having to do something extra for getResource, but think that was actually so getResource would list protected pages.

I think I see the problem, or at least part of it. My Wayfinder snippet is cached, so some pages show it and some don't. Apparently when you have protected pages, it's best to have Wayfinder uncached.

Also i know you probably are, but have you tried logging out of manager or viewing in another browser as i've before given admin account access permission

That would explain why you can see them in a menu, but you still shouldn't be able to view the page. You flushed permissions?

Ok. Seems to be all better now; between being logged in as the "su" admin user and having the Wayfinder cached, it was all messed up.

Bottom line is: uncached Wayfinder calls so the page doesn't get cached with the protected page in the menu when an Admin user views it. Or something like that. [ed. note: sottwell last edited this post 14 years ago.]