Skip to content

Commit 14c50b0

Browse files
javiereguiluzjaviereguiluz
committed
minor #19674 [Security] Replace a complex table by a list (javiereguiluz)
This PR was squashed before being merged into the 5.4 branch. Discussion ---------- [Security] Replace a complex table by a list The table at https://symfony.com/doc/current/security/access_control.html looks bad because it's very complex: ![image](https://github.com/symfony/symfony-docs/assets/73419/6329dd91-bad1-4021-9719-ed38ff98ba24) I propose to replace it by a list of items, which is a very common element in Symfony Docs. Commits ------- 7c2f917 [Security] Replace a complex table by a list
2 parents db1ea10 + 7c2f917 commit 14c50b0

File tree

1 file changed

+43
-27
lines changed

1 file changed

+43
-27
lines changed

‎security/access_control.rst

Lines changed: 43 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -137,33 +137,49 @@ For each incoming request, Symfony will decide which ``access_control``
137137
to use based on the URI, the client's IP address, the incoming host name,
138138
and the request method. Remember, the first rule that matches is used, and
139139
if ``ip``, ``port``, ``host`` or ``method`` are not specified for an entry, that
140-
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``:
141-
142-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
143-
| URI | IP | PORT | HOST | METHOD | ``access_control`` | Why? |
144-
+=================+=============+=============+=============+============+================================+=============================================================+
145-
| ``/admin/user`` | 127.0.0.1 | 80 | example.com | GET | rule #2 (``ROLE_USER_IP``) | The URI matches ``path`` and the IP matches ``ip``. |
146-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
147-
| ``/admin/user`` | 127.0.0.1 | 80 | symfony.com | GET | rule #2 (``ROLE_USER_IP``) | The ``path`` and ``ip`` still match. This would also match |
148-
| | | | | | | the ``ROLE_USER_HOST`` entry, but *only* the **first** |
149-
| | | | | | | ``access_control`` match is used. |
150-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
151-
| ``/admin/user`` | 127.0.0.1 | 8080 | symfony.com | GET | rule #1 (``ROLE_USER_PORT``) | The ``path``, ``ip`` and ``port`` match. |
152-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
153-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | GET | rule #3 (``ROLE_USER_HOST``) | The ``ip`` doesn't match neither the first rule nor the |
154-
| | | | | | | second rule. So the third rule (which matches) is used. |
155-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
156-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | POST | rule #3 (``ROLE_USER_HOST``) | The third rule still matches. This would also match the |
157-
| | | | | | | fourth rule (``ROLE_USER_METHOD``), but only the **first** |
158-
| | | | | | | matched ``access_control`` is used. |
159-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
160-
| ``/admin/user`` | 168.0.0.1 | 80 | example.com | POST | rule #4 (``ROLE_USER_METHOD``) | The ``ip`` and ``host`` don't match the first three |
161-
| | | | | | | entries, but the fourth - ``ROLE_USER_METHOD`` - matches |
162-
| | | | | | | and is used. |
163-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
164-
| ``/foo`` | 127.0.0.1 | 80 | symfony.com | POST | matches no entries | This doesn't match any ``access_control`` rules, since its |
165-
| | | | | | | URI doesn't match any of the ``path`` values. |
166-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
140+
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``.
141+
See the following examples:
142+
143+
Example #1:
144+
* **URI** ``/admin/user``
145+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``GET``
146+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
147+
* **Why?** The URI matches ``path`` and the IP matches ``ip``.
148+
Example #2:
149+
* **URI** ``/admin/user``
150+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
151+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
152+
* **Why?** The ``path`` and ``ip`` still match. This would also match the
153+
``ROLE_USER_HOST`` entry, but *only* the **first** ``access_control`` match is used.
154+
Example #3:
155+
* **URI** ``/admin/user``
156+
* **IP**: ``127.0.0.1``, **Port**: ``8080``, **Host**: ``symfony.com``, **Method**: ``GET``
157+
* **Rule applied**: rule #1 (``ROLE_USER_PORT``)
158+
* **Why?** The ``path``, ``ip`` and ``port`` match.
159+
Example #4:
160+
* **URI** ``/admin/user``
161+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
162+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
163+
* **Why?** The ``ip`` doesn't match neither the first rule nor the second rule.
164+
* So the third rule (which matches) is used.
165+
Example #5:
166+
* **URI** ``/admin/user``
167+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
168+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
169+
* **Why?** The third rule still matches. This would also match the fourth rule
170+
* (``ROLE_USER_METHOD``), but only the **first** matched ``access_control`` is used.
171+
Example #6:
172+
* **URI** ``/admin/user``
173+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``POST``
174+
* **Rule applied**: rule #4 (``ROLE_USER_METHOD``)
175+
* **Why?** The ``ip`` and ``host`` don't match the first three entries, but
176+
* the fourth - ``ROLE_USER_METHOD`` - matches and is used.
177+
Example #7:
178+
* **URI** ``/foo``
179+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
180+
* **Rule applied**: matches no entries
181+
* **Why?** This doesn't match any ``access_control`` rules, since its URI
182+
* doesn't match any of the ``path`` values.
167183

168184
.. caution::
169185

0 commit comments

Comments
 (0)