I thought I could protect some panels by adding restrictions on related URIs (/history, /logbook, …) but it seems to not work because when you click (eg) “History” in the frontend the page is not refreshed. (the page will be denied if I manually refresh the page).
Is the objective to remove (eg) History and/or Logbook from the dashboard, for the use case of, say, a kiosk control panel on the wall in the living room?
Elaborate on why you want to do this would be great.
You should always test your setup with an inprivate/private/incognito browser.
If the page is not refreshed, then it means it is cached because you have visited it before.
The one you block access for would probably never have been on the page before, so you need to see it as they do.
Hi, yes this is the use case but since I failed to remove the entries from the frontend I am trying to put in place some ACL (which would more secure anyway)
I believe this is per browser and/or per user (you probably could create a kiosk-only user anyways).
Not 100% block since people could still manually type in (e.g.) /history in the address bar if they absolutely wants to, but could be helpful.
That sounds like a good solution to keep trusted people in the correct areas. Just remember referrer spoofing is possible and it was even simple the last time I used it.