Geek asks and answers

Symfony 2 - hide the whole site using the HTTP Authentication dialog

I am using Symfony 2 to create a website.

Work is being done (therefore, I do not want users or search engines to access it), but my client wants to see my progress. I thought the simple solution was to secure the entire site with HTTP authentication, using the mechanism provided by the Symfony 2 security functionality.

I use FOSUserBundle, as there will be users on the site who need to register and log in.

This is my security.yml that works fine:

security:
    providers:
        fos_userbundle:
            id: fos_user.user_manager

    encoders:
        "FOS\UserBundle\Model\UserInterface": sha512

    firewalls:
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_provider: form.csrf_provider
            logout:       true
            anonymous:    true     

    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/account, role: IS_AUTHENTICATED_FULLY }

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

So I was trying to add something else on top of it so that the website could be protected by HTTP authentication.
I changed the file to:

security:
    providers:
        fos_userbundle:
            id: fos_user.user_manager
        whole_website_provider:
            users:
                ryan:  { password: ryanpass, roles: 'ROLE_USER' }           

    encoders:
        "FOS\UserBundle\Model\UserInterface": sha512

    firewalls:
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_provider: form.csrf_provider
            logout:       true
            anonymous:    true
        whole_website:
            pattern: ^/
            anonymous: ~
            http_basic:
                realm: "Secured Demo Area"       

    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/account, role: IS_AUTHENTICATED_FULLY }
        - { path: ^/, role: ROLE_USER }

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

whole_website_provider, whole_website access_control.
: -, , .

, ?

N.B.: - Apache.

+5
2

, HTTP, HTTP-. Symfony2.

symfony2 , , apache.htaccess, .

http://httpd.apache.org/docs/2.2/howto/auth.html. web/.htaccess /, ...

+4

Symfony2, symfony ( FOSUserBundle):

# app/config/security.yml
security:

    firewalls:
        secured_area:
            pattern: ^/
            anonymous: ~
            form_login:
                login_path: login
                check_path: login_check

    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin, roles: ROLE_ADMIN }
        - { path: ^/, roles: ROLE_USER }

    providers:
        in_memory:
            memory:
                users:
                    redattore: { password: 'somePasswordHere', roles: 'ROLE_USER' }
                    admin: { password: 'somePasswordHere', roles: 'ROLE_ADMIN' }

    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

. - , ( ":" ), https ( ), . , .

0

More articles:


All Articles