3

In my Symfony 2.3.1 Security YML, I have this line.

security.yml

access_control:
    - { path: ^/mysecurearea, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 0.0.0.0 }

Based on this: http://symfony.com/doc/current/book/security.html

I was under the impression that this route and routes like it, e.g. /mysecurearea/something should only be accessible to a request from IP 0.0.0.0

Problem is, I can still access it.

Any ideas?

4
  • are you logged when trying to access mysecurearea ?
    – 0x1gene
    Oct 4, 2013 at 8:52
  • No. I worked out what the issue is, but I will wait a couple of days and see if anyone else comes up with the answer. Then I can give them points by marking their answer as correct.
    – Adi
    Oct 4, 2013 at 15:20
  • Did you clear your cache? What is in your firewalls section? Oct 5, 2013 at 5:31
  • Cache is fine. The firewall just has login info for /^, but that doesn't effect access to anything. e.g. IS_AUTHENTICATED_ANONYMOUSLY has access to /^
    – Adi
    Oct 5, 2013 at 22:57

2 Answers 2

6

So, all I wanted to do, was stop people from access an area, unless they had a valid IP. What I hadn't entirely appreciated, was that access_control can only give roles, rather than deny access. (Makes sense in hindsight.)

    - { path: ^/mysecurearea, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 0.0.0.0 }
    - { path: ^/mysecurearea, roles: ROLE_NO_ACCESS }

So to achieve what I was looking for, I needed to add the additional line above. ROLE_NO_ACCESS doesn't actually exist. You just need to add some text there which is descriptive and note a valid role. Since it isn't a valid role, the requester can no longer access the area. It is a bit of a hack, but for my purposes, it does the job perfectly.

4
  • If I use this solution I always get "ERR_TOO_MANY_REDIRECTS" having a firewall rule in place (login_path: /login use_forward: false). What can I do?
    – lony
    Nov 10, 2015 at 15:32
  • It suggests that where they are being bumped to, is not accessible to that user either. e.g. When Symfony can't match for the area, it redirects/forwards the user to the login page. Thus if it can't match for the login page either, then it will get into an infinite loop. Is an anonymous user able to access the login page?
    – Adi
    Nov 10, 2015 at 17:12
  • No the complete login should only be possible for certain ip addresses. How can I fix this? That login and everything restricted shows a "not found" if it is called from a non allowed ip address and second that if it is the right ip the person accessing restricted areas is redirected to the login, just as normally.
    – lony
    Nov 11, 2015 at 11:15
  • made a new question from my comment
    – lony
    Nov 11, 2015 at 15:10
3

My security.yml had some default entries that were somehow causing it to ignore the IP rules. I don't have any login functionality so my use case is quite simple.

Here is my entire security.yml that works for me in Symfony 2.3.6:

security:
    firewalls:
        anonymous:
            anonymous: ~

    providers:
        in_memory:
            memory:

    access_control:
        - { path: ^/foo, roles: IS_AUTHENTICATED_ANONYMOUSLY, ips: [127.0.0.1, ::1] }
        - { path: ^/foo, roles: ROLE_NO_ACCESS }

Just change the ^/foo path and the list of IPs.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.