Symfony Diem：如何确保整个前端安全？

Question

How can I secure whole frontend site, given that module responsible for login management (dmUser) is part of frontend, so it cannot be called without login (eternal forwards)? And if I write my custom login module it's still called via dmFront, ie within "secure zone" and ends up with eternal forwards?

One solution would be making each and every front page secure individually, but it's not possible due to specifics of this particular projet

Answer 1

I don't know about diem specifically, but typically you would edit apps/frontend/config/security.yml and set:

default:
  is_secure: true

And then set your actions that need to be insecure (login, forgot password etc) as is_secure: false . See the documentation but an example you could create /apps/frontend/your_module_that_handles_logins/config/security.yml and put:

Login:
  is_secure: false

Forgot_password:
  is_secure: false

And whatever other actions you need to not be secure.