Question

我正在使用Symfony Security组件在Silex中开发一个应用程序。匿名用户应该能够访问除管理员部分（^ / admin）之外的每个应用程序点。

我做错了什么？匿名仍然可以访问管理员部分。我已经按照其他一些答案来达到这一点，但现在我被卡住了。

$app['security.firewalls'] = array
(
    'general' => array
    (
        'pattern' => '^/',
        'anonymous' => true,
        'form' => array
        (
            'login_path' => '/login',
            'check_path' => '/admin/login_check',
            'default_target_path' => '/admin',
            'always_use_default_target_path' => true,
        ),
        'logout' => array
        (
            'logout_path' => '/admin/logout',
            'target_url' => '/'
        ),
        'users' => $app->share(function() use ($app) {
            return new UserProvider($app['db']);
        })
    )
);

// @todo - find out why anonymous can see admin panel
$app['security.access_control'] = array
(
    array('path' => '^/login', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
    array('path' => '^/admin', 'role' => 'ROLE_USER'),
);

$app['security.role_hierarchy'] = array
(
    'ROLE_ADMIN' => array('ROLE_USER'),
);

Answer 1

查看文档 http://symfony.com/doc/current/book/security.html#basic-example-http-authentication

'access_control' => array(
    array('path' => '^/admin/', 'role' => 'ROLE_ADMIN'),
    // Include the following line to also secure the /admin path itself
    // array('path' => '^/admin$', 'role' => 'ROLE_ADMIN'),
),

它的^ / admin /或^ / admin $ not ^ / admin

Answer 2

我已将security.access_control（现在似乎被忽略）更改为security.access_rules（之前将“access_rules”错误称为“未知属性”）现在似乎有效：

$app['security.access_rules'] = array ( array('^/admin', 'ROLE_USER'), );

匿名者可以看到保护区

2 个答案: