Silex SecurityServiceProvider，匿名设置不起作用

Question

Right now I'm developing a simple API for a continuous integration server with Silex. Now the api should be accessible to everyone with secret key, but for logged in users I want api to be available without any key.

Now the configuration for SecurityServiceProvider looks like this:

'security.firewalls' => array(

    'login' => array(
        'pattern' => '^/auth/login'
    ),
    'secured' => array(
        'pattern' => '^/',
        'form' => array(
            'login_path' => "/auth/login",
            'check_path' => "/auth/dologin",
            'username_parameter' => 'login[username]',
            'password_parameter' => 'login[password]',
            "csrf_parameter" => "login[_token]",
            "failure_path" => "/auth/login",
        ),
        'logout' => array(
            'logout_path' => "/auth/logout",
            "target" => '/',
            "invalidate_session" => false
        ),
        'users' => array(
            // admin:foo
            'admin' => array('ROLE_ADMIN', '5FZ2Z8QIkA7UTZ4BYkoC+GsReLf569mSKDsfods6LYQ8t+a8EW9oaircfMpmaLbPBh4FOBiiFyLfuZmTSUwzZg==')
        )
    ),'api' => array(
        'pattern' => '^/api',
        'anonymous' => true
    ),
)

The sad thing is that when I'm on /api/ pages it still redirects me to login page, although as you can see anonymous => true.

I can move firewall for /api at the top and remove anonymous line, but then I don't have access to SecurityContext object to check if user is authenticated.

Answer 1

Allow anonymous users in general and use access rules to define protected areas:

// init the firewall
$app->register(new Silex\Provider\SecurityServiceProvider(), array(
'security.firewalls' => array(
    'general' => array(
        'pattern' => '^/',
        'anonymous' => true,
        'form' => array(
            'login_path' => '/login',
            'check_path' => '/admin/login_check'
        ),
        'users' => $app->share(function  () use( $app)
        {
            return new UserProvider($app);
        }),
        'logout' => array(
            'logout_path' => '/admin/logout',
            'target_url' => '/goodbye'
        )
    )
),
'security.access_rules' => array(
    array('^/admin', 'ROLE_ADMIN')
),
'security.role_hierarchy' => array(
    'ROLE_ADMIN' => array('ROLE_USER', 'ROLE_ALLOWED_TO_SWITCH')
)

));

If you want protect all except /api just define two firewalls:

// init the firewall
$app->register(new Silex\Provider\SecurityServiceProvider(), array(
'security.firewalls' => array(
    'anonymous' => array(
        'pattern' => '^/api',
        'anonymous' => true
    ),
    'general' => array(
        'pattern' => '^/',
        'anonymous' => false,
        ...
    )
),