@@ -476,9 +476,12 @@ will be able to authenticate (e.g. login form, API token, etc).
476
476
security :
477
477
# ...
478
478
firewalls :
479
+ # the order in which firewalls are defined is very important, as the
480
+ # request will be handled by the first firewall whose pattern matches
479
481
dev :
480
482
pattern : ^/(_(profiler|wdt)|css|images|js)/
481
483
security : false
484
+ # a firewall with no pattern should be defined last because it will match all requests
482
485
main :
483
486
lazy : true
484
487
# provider that you set earlier inside providers
@@ -504,10 +507,14 @@ will be able to authenticate (e.g. login form, API token, etc).
504
507
505
508
<config >
506
509
<!-- ... -->
510
+
511
+ <!-- the order in which firewalls are defined is very important, as the
512
+ request will be handled by the first firewall whose pattern matches -->
507
513
<firewall name =" dev"
508
514
pattern =" ^/(_(profiler|wdt)|css|images|js)/"
509
515
security =" false" />
510
516
517
+ <!-- a firewall with no pattern should be defined last because it will match all requests -->
511
518
<firewall name =" main"
512
519
lazy =" true" />
513
520
@@ -526,11 +533,15 @@ will be able to authenticate (e.g. login form, API token, etc).
526
533
527
534
return static function (SecurityConfig $security): void {
528
535
// ...
536
+
537
+ // the order in which firewalls are defined is very important, as the
538
+ // request will be handled by the first firewall whose pattern matches
529
539
$security->firewall('dev')
530
540
->pattern('^/(_(profiler|wdt)|css|images|js)/')
531
541
->security(false)
532
542
;
533
543
544
+ // a firewall with no pattern should be defined last because it will match all requests
534
545
$security->firewall('main')
535
546
->lazy(true)
536
547
0 commit comments