Security intro

Firewalls concept

A firewall is a named zone that guards a part of the site. Each request enters one firewall, usually called main, which decides how login works there.

Anonymous visitors may read public zones but stop at guarded ones. Login methods like forms attach to the firewall, not to single pages.

Think of the firewall as the front door and access rules as room keys. The next section writes those keys.

Access control

Access control lists URL patterns with the roles they need. The first matching rule wins, so order the list from strict to open.

The line below locks every admin path to the admin role. Public pages need no line at all.

security: access_control: - { path: ^/admin, roles: ROLE_ADMIN }

Roles

Roles are simple strings like ROLE_USER and ROLE_ADMIN. Users carry a list of them, and each rule or check names the ones it accepts.

The isGranted call tests the current visitor anywhere in PHP code. Use it for small branches that templates cannot cover.

if ($this->isGranted("ROLE_ADMIN")) { echo "Welcome to the back office"; }

Deny in controllers

Whole actions need a guard at the top, not a branch in the middle. The deny helper throws when the visitor lacks the role.

Place it as the first line of the action. Forbidden visitors see the standard 403 page without extra code.

$this->denyAccessUnlessGranted("ROLE_ADMIN");

Next: Users

Article author: Arthur Isaev