Kirby Security and Auth

KB entry points

• kirby://kb/scenarios/62-access-restriction-login
• kirby://kb/scenarios/43-user-registration-and-login
• kirby://kb/scenarios/63-files-firewall-protected-downloads
• kirby://kb/scenarios/64-permission-tricks-role-based
• kirby://kb/scenarios/67-indieauth-rel-me

Required inputs

• Protected pages/data and required roles.
• Login/logout flow and redirect rules.
• Download protection or route constraints.

Role matrix template

Default guard pattern

• Check $kirby->user() and required role/permission before returning content.
• Redirect or return a 403 for unauthorized requests.
• Enforce CSRF and validation on auth-related forms.

Login redirect rule

• Store intended URL in the session and redirect after successful login.
• Fall back to the home page when no intent is stored.

Common pitfalls

• Checking access only in templates while routes remain public.
• Returning a 404 for unauthorized access instead of a 403 or redirect.

Verification checklist

• Test the role matrix across protected pages and downloads.
• Verify login/logout flows and session handling.
• Confirm CSRF failures render safely.

Workflow

1. Clarify which pages/data are protected, required roles, and login/logout behavior.
2. Call kirby:kirby_init and read kirby://roots.
3. Inspect templates/controllers/blueprints to align with existing patterns:

- kirby:kirbytemplatesindex - kirby:kirbycontrollersindex - kirby:kirbyblueprintsindex

1. For protected downloads or auth routes, inspect routes with kirby:kirbyroutesindex and kirby://config/routes (install runtime if needed).
2. Search the KB with kirby:kirby_search (examples: "access restriction login", "user registration and login", "files firewall", "permission tricks", "page on own domain").
3. Implement least-privilege checks in templates/controllers or routes; enforce CSRF and validation on auth forms.
4. Verify by rendering protected pages (kirby:kirbyrenderpage) and manually testing login and download URLs.