@@ -34,7 +34,7 @@ Basic Example: HTTP Authentication
34
34
The Security component can be configured via your application configuration.
35
35
In fact, most standard security setups are just a matter of using the right
36
36
configuration. The following configuration tells Symfony to secure any URL
37
- matching ``/admin* `` and to ask the user for credentials using basic HTTP
37
+ matching ``/admin/ * `` and to ask the user for credentials using basic HTTP
38
38
authentication (i.e. the old-school username/password box):
39
39
40
40
.. configuration-block ::
@@ -51,7 +51,9 @@ authentication (i.e. the old-school username/password box):
51
51
realm : " Secured Demo Area"
52
52
53
53
access_control :
54
- - { path: ^/admin, roles: ROLE_ADMIN }
54
+ - { path: ^/admin/, roles: ROLE_ADMIN }
55
+ # Include the following line to also secure the /admin path itself
56
+ # - { path: ^/admin$, roles: ROLE_ADMIN }
55
57
56
58
providers :
57
59
in_memory :
@@ -79,7 +81,9 @@ authentication (i.e. the old-school username/password box):
79
81
</firewall >
80
82
81
83
<access-control >
82
- <rule path =" ^/admin" role =" ROLE_ADMIN" />
84
+ <rule path =" ^/admin/" role =" ROLE_ADMIN" />
85
+ <!-- Include the following line to also secure the /admin path itself -->
86
+ <!-- <rule path="^/admin$" role="ROLE_ADMIN" /> -->
83
87
</access-control >
84
88
85
89
<provider name =" in_memory" >
@@ -108,7 +112,9 @@ authentication (i.e. the old-school username/password box):
108
112
),
109
113
),
110
114
'access_control' => array(
111
- array('path' => '^/admin', 'role' => 'ROLE_ADMIN'),
115
+ array('path' => '^/admin/', 'role' => 'ROLE_ADMIN'),
116
+ // Include the following line to also secure the /admin path itself
117
+ // array('path' => '^/admin$', 'role' => 'ROLE_ADMIN'),
112
118
),
113
119
'providers' => array(
114
120
'in_memory' => array(
@@ -143,9 +149,9 @@ that looks like the following:
143
149
144
150
* There are two users in the system (``ryan `` and ``admin ``);
145
151
* Users authenticate themselves via the basic HTTP authentication prompt;
146
- * Any URL matching ``/admin* `` is secured, and only the ``admin `` user
152
+ * Any URL matching ``/admin/ * `` is secured, and only the ``admin `` user
147
153
can access it;
148
- * All URLs *not * matching ``/admin* `` are accessible by all users (and the
154
+ * All URLs *not * matching ``/admin/ * `` are accessible by all users (and the
149
155
user is never prompted to log in).
150
156
151
157
Read this short summary about how security works and how each part of the
@@ -193,7 +199,7 @@ Access Controls (Authorization)
193
199
If a user requests ``/admin/foo ``, however, the process behaves differently.
194
200
This is because of the ``access_control `` configuration section that says
195
201
that any URL matching the regular expression pattern ``^/admin `` (i.e. ``/admin ``
196
- or anything matching ``/admin* ``) requires the ``ROLE_ADMIN `` role. Roles
202
+ or anything matching ``/admin/ * ``) requires the ``ROLE_ADMIN `` role. Roles
197
203
are the basis for most authorization: a user can access ``/admin/foo `` only
198
204
if it has the ``ROLE_ADMIN `` role.
199
205
0 commit comments