# Authentication Allow All Actions Except

**URL:** <https://discourse.cakephp.org/t/authentication-allow-all-actions-except/9655>\
**Category:** Uncategorized\
**Created:** [August 23, 2021, 6:36am UTC](https://discourse.cakephp.org/t/authentication-allow-all-actions-except/9655 "2021-08-23T06:36:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yousuo](https://avatars.discourse-cdn.com/v4/letter/y/898d66/32.png) [@yousuo](https://discourse.cakephp.org/u/yousuo)\
**Post date:** [August 23, 2021, 6:36am UTC](https://discourse.cakephp.org/t/authentication-allow-all-actions-except/9655/1 "2021-08-23T06:36:34Z")

</div>

hi,

For Cake 4 [authentication plugin](https://book.cakephp.org/authentication/2/en/authentication-component.html).

Currently, `allowUnauthenticated()` only allow certain actions w/o authentication (e.g. login). But I want it to be the other way around, something like `allowAllExcept()`, like to allow all actions except…

In other words, is there a way to allow **all actions except certain actions**?

---

<div class="post-metadata">

**Author:** ![KevinPfeifer](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kevinpfeifer/32/3365_2.png) [@KevinPfeifer](https://discourse.cakephp.org/u/KevinPfeifer)\
**Post date:** [August 23, 2021, 4:16pm UTC](https://discourse.cakephp.org/t/authentication-allow-all-actions-except/9655/2 "2021-08-23T16:16:06Z")

</div>

Maybe this can be seen as a bit of a hack but with a reflection class you can get all public methods present in your controller.

```auto
  public function beforeFilter( EventInterface $event ) {
    parent::beforeFilter( $event );
    $class = new \ReflectionClass(self::class);
    $public_methods = $class->getMethods(\ReflectionMethod::IS_PUBLIC);
    $disallowed_methods = ['edit', 'other'];
    $allowed_methods = [];
    foreach($public_methods as $public_method):
      if($public_method->class === self::class) {
        if(!in_array($public_method->name, $disallowed_methods)) {
          $allowed_methods[] = $public_method->name;
        }
      }
    endforeach;
    $this->Authentication->allowUnauthenticated($allowed_methods);
  }

```