Symfony2初学者安全上下文问题

Question

Up until recently I have had an area open to the public (/ and /whatever) and a secured area that required ROLE_USER (/portal and /portal/whatever). Now I want to create an admin area inside my secured area which would require ROLE_ADMIN. (/portal/admin and /portal/admin/whatever).

I have security.yml looks as follows:

    firewalls:
    login_firewall:
      pattern:    ^/portal/login$
      anonymous:  ~
    secured_area:
        pattern:    ^/portal
        form_login:
            login_path:  portal_login
            check_path:  login_check
            default_target_path: portal_dashboard  
        logout:
            path:   portal_logout
            target: portal_dashboard
        http_basic:
            realm: "MyFreelancer Client Portal"

    access_control:
    - { path: ^/portal/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/portal/, roles: ROLE_USER }
    - { path: ^/portal/admin, roles: ROLE_ADMIN }

I have just added the third line. My problem is that a user with ROLE_USER can still access ^/portal/admin. Could someone please explain to me why this does not work?

An alternative is to have the admin area under /admin and /admin/whatever, but this requires a completely different firewall context and I am not quite sure how to do that. I tried, but it kept taking me back to /portal/ and when I browse to /admin/ it asks to log in again and then takes me back to /portal/ again (endless loop).

If, as an ancilliary answer, you could explain to me the pro's and con's of single firewall context for user area and admin area vs seperate firewall contexts and how this is implemented (if necessary)?

Thank you in advance.

UPDATE: I have found that simply swopping the two bottom lines fixes the problem, as it runs through them sequetially and thus /portal/admin/ got run against the second line, which only requires ROLE_USER. If someone could still give me some insight on whether it would be better to run the admin area on a seperate firewall context or not and why, and if so, how?

Answer 1

When setting up your access_control, make sure that your routes are in such an order that a route will not match one of the routes above. For instance, place ^/admin/login/ above ^/admin/, otherwise the first match (which would be ^/admin/) will be triggered.