Security in Symfony2

Question

I've created a Bundle named "User". In the general routing I added /user to every UserBundle url. So, for example, when I define the route /list in the UserBundle the real path is http://myapp.loc/user/list.

I'm trying to force user to login to use this website, an I'm doing this:

security:
       firewalls:
          login_firewall:
              pattern:    ^/user/login
              anonymous:  ~
          secured_area:
              pattern:    ^/
              form_login:
                   login_path: user_login
                   check_path: user_login_check
                   default_target_path: /
              logout:
                   path: /user_logout
                   target: user_login
              remember_me:
                    key:      atipics-soft2012
                    lifetime: 3600           
       access_control:
           - { path: ^/, roles: ROLE_USER }
       providers:
           users:
               entity: { class: MyApp\UserBundle\Entity\User, property:email }
       encoders:
           MyApp\UserBundle\Entity\User: { algorithm:  sha512, iterations: 10 }

I'm getting an error like this:

InvalidConfigurationException: Invalid configuration for path "security.firewalls.secured_area": The check_path "user_login_check" for login method "form_login" is not matched by the firewall pattern "^/".

What could be the problem?

Of couse I've added this route in the routes file.

You need to exclude the login page from your access control because otherwise no user can access your login page without logging in. The documentation is pretty good on the security stuff and should guide you. — Sgoettschkes
You're right, but, I already tryied that. The point is to secure the whole app. Do you know some method? — Bernat
try adding - { path: ^/user_login, roles: IS_AUTHENTICATED_ANONYMOUSLY } to your access_controll list. — Sgoettschkes

Elnur Abdurrakhimov Elnur Abdurrakhimov · Accepted Answer · 2012-04-27T10:25:57

I don't know if it's a bug or was intented this way, but check_path doesn't accept route names. You have to set it to a path.

Security in Symfony2

1 Answers