@@ -2,31 +2,20 @@ security:
22 access_decision_manager :
33 strategy : unanimous
44 allow_if_all_abstain : true
5+
56 # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
67 password_hashers :
78 Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface : ' auto'
9+
810 # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
911 providers :
1012 sulu :
1113 id : sulu_security.user_provider
12- # Easy way to control access for large sections of your site
13- # Note: Only the *first* access control that matches will be used
14- access_control :
15- - { path: ^/admin/reset, roles: PUBLIC_ACCESS }
16- - { path: ^/admin/security/reset, roles: PUBLIC_ACCESS }
17- - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
18- - { path: ^/admin/2fa, roles: PUBLIC_ACCESS }
19- - { path: ^/admin/_wdt, roles: PUBLIC_ACCESS }
20- - { path: ^/admin/_profiler, roles: PUBLIC_ACCESS }
21- - { path: ^/admin/translations, roles: PUBLIC_ACCESS }
22- - { path: ^/admin$, roles: PUBLIC_ACCESS }
23- - { path: ^/admin/$, roles: PUBLIC_ACCESS }
24- - { path: ^/admin/p/, roles: PUBLIC_ACCESS }
25- - { path: ^/admin, roles: ROLE_USER }
2614
2715 firewalls :
2816 dev :
29- pattern : ^/(_(profiler|wdt)|css|images|js)/
17+ # Ensure dev tools and static assets are always allowed
18+ pattern : ^/(_profiler|_wdt|assets|build)/
3019 security : false
3120 admin :
3221 pattern : ^/admin(\/|$)
@@ -55,7 +44,7 @@ security:
5544 # # For an advanced user management with registration and opt-in emails have a look at the:
5645 # # https://github.com/sulu/SuluCommunityBundle
5746 # # Also have a look at the user context based caching when you output user role specific data
58- # # https://docs.sulu.io/en/2.2 /cookbook/user-context-caching.html
47+ # # https://docs.sulu.io/en/2.6 /cookbook/user-context-caching.html
5948 # form_login:
6049 # login_path: login
6150 # check_path: login
@@ -67,19 +56,31 @@ security:
6756 # lifetime: 604800 # 1 week in seconds
6857 # path: /
6958 #
70- # # activate different ways to authenticate
59+ # # Activate different ways to authenticate:
7160 # # https://symfony.com/doc/current/security.html#the-firewall
7261 #
7362 # # https://symfony.com/doc/current/security/impersonating_user.html
7463 # # switch_user: true
7564
65+ # Note: Only the *first* matching rule is applied
66+ access_control :
67+ - { path: ^/admin/reset, roles: PUBLIC_ACCESS }
68+ - { path: ^/admin/security/reset, roles: PUBLIC_ACCESS }
69+ - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
70+ - { path: ^/admin/2fa, roles: PUBLIC_ACCESS }
71+ - { path: ^/admin/_wdt, roles: PUBLIC_ACCESS }
72+ - { path: ^/admin/_profiler, roles: PUBLIC_ACCESS }
73+ - { path: ^/admin/translations, roles: PUBLIC_ACCESS }
74+ - { path: ^/admin$, roles: PUBLIC_ACCESS }
75+ - { path: ^/admin/$, roles: PUBLIC_ACCESS }
76+ - { path: ^/admin/p/, roles: PUBLIC_ACCESS }
77+ - { path: ^/admin, roles: ROLE_USER }
78+
7679when@test :
7780 security :
7881 password_hashers :
79- # By default, password hashers are resource intensive and take time. This is
80- # important to generate secure password hashes. In tests however, secure hashes
81- # are not important, waste resources and increase test times. The following
82- # reduces the work factor to the lowest possible values.
82+ # Password hashers are resource-intensive by design to ensure security.
83+ # In tests, it's safe to reduce their cost to improve performance.
8384 Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface :
8485 algorithm : auto
8586 cost : 4 # Lowest possible value for bcrypt
0 commit comments