Yii2. How to make a redirect to authorization?

Question

Yii

Hello!
Faced a very unpleasant problem, all the solutions found did not help.
I created a project based on yii2-advanced (I work in the backend for now), added a couple of modules (including users).
When an unauthorized user enters the module page, he is redirected to the page with authorization. Everything works fine, except when we go to a page like: project.dev/random_string. In this case, a 404 error page is displayed with all the data available to authorized users.
Those. when working correctly, it should first transfer to the page with authorization, and then to the selected page with an error.
I understand that the problem is somewhere in the configs. Those. access control for site and modules works as specified, but accessing a non-existent module causes this problem.
Code from backend\SiteController

public function behaviors()
    {
        return [
            'access' => [
                'class' => AccessControl::className(),
                'rules' => [
                    [
                        'actions' => ['login', 'error'],
                        'allow' => true,
                    ],
                    [
                        'actions' => ['logout', 'index'],
                        'allow' => true,
                        'roles' => ['@'],
                    ],
                ],
            ],
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'logout' => ['post'],
                ],
            ],
        ];
    }

Part of the config from backend\main.php

'urlManager' => [
            'enablePrettyUrl' => true,
            'showScriptName' => false,
            'rules' => [
                'login' => 'site/login',
                '' => 'site/index'
            ],
        ],

Thanks in advance.

Answer 1

In this case, a 404 error page is displayed with all the data available to authorized users.

Well, change the layout for the page with errors, so that there is nothing superfluous. Making an error page available only to a registered user is a very big mistake. Including because of the possibility to catch a cyclic redirection.