Restricting front-end access to (anonymous)

So you're saying that the only way for me would be to manually add each resource to a resource group after creating them? To me that doesn't make sense. The access permissions of the anonymous user group just gets ignored on the front-end. I hope one of the github contributors will pick this issue up and fix this to make the permission system more consistent and flexible. For now, I'll stick with the small snippet I wrote earlier to get the desired result.

What most people do is use something like the DefaultResourceGroup plugin, which automatically puts every new resource in a group that's already protected. I call my resource group allDocs.

Yeah, this discussion comes up from time to time. MODX is "public by default", you have to specifically protect pages. There are a number of plugins to assist in managing resources and their groups. Besides the one BobRay mentions above, there's one to have child resources inherit their parents' groups. http://modx.com/extras/package/inheritresourcegroup

Sure, 'Public by default' makes sense. That's what the permissions are set to and that's what the expectations are for a CMS. But providing the tools to adjust permissions per context and actually ignoring them once someone changes them is really confusing. Again, this takes away a lot of flexibility and consistency in the system. Why is it that I can assign policies to the anonymous group in a context if it doesn't even do anything? Am I the only one thinking this?

I think its important that the web context be open, or at least there is a good argument for why it should be so.

For any developer, if you want to restrict access to a page, to any groups or users at all, by all means do not put it in the web context.

Basically, you need to decide which side of the fence you are going to err on. There *has* to be an open part of the system, even if the developer finally decides to put all resources in other contexts.

Of course handyface has a good argument here, that there shouldn't be a system of fixing permissions that aren't respected. But that's different then the issue of the default permissions on the web context. Anyway I am not a developer.

Sure, the web context (and any context) should be open by default. But ModX is the perfect candidate for more than just a single website. That's why I chose modx in the first place. I saw the potential to make a web application with multiple layers of access groups by using contexts. As of right now however, you can't deny access to any context without using a plugin or a snippet to program it manually. That seems weird since the tools are already there.

Yes permissions and contexts are a little tough to deal with. You can do anything you want, but its hard to implement.