Symfony2 Firewall not preventing access - php

Question

I think I don't fully understand the concept of firewall and access control of symfony but here's my understanding.
I have FOSUserBundle installed and configured properly.
I created some roles:
role_hierarchy:
ROLE_COACH: [ROLE_USER]
ROLE_EDITOR: [ROLE_USER]
ROLE_PREMIUM_COACH : [ROLE_USER, ROLE_COACH]
ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN, ROLE_COACH, ROLE_EDITOR, ROLE_PREMIUM_COACH]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
I want to prevent people from accessing the url /dashboard if they are not logged in, therefore if they don't have the role ROLE_USER.
Here's my firewall:
firewalls:
# -> custom firewall for the admin area of the URL
admin:
pattern: /admin(.*)
form_login:
provider: fos_userbundle
login_path: /admin/login
use_forward: false
check_path: /admin/login_check
failure_path: null
logout:
path: /admin/logout
anonymous: true
# -> end custom configuration
# defaut login area for standard users
main:
pattern: .*
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /login
use_forward: false
check_path: /login_check
failure_path: null
logout: true
anonymous: true
Here's what I added under access_control:
- { path: ^/dashboard, role: [ROLE_USER]}
- { path: ^/dashboard/blog, role: [ROLE_EDITOR]}
I can access the page /dashboard even if I'm not connected and I don't want that possible. What am I getting wrong ?

Answer 1

From that pastebin
- { path: ^/.*, role: IS_AUTHENTICATED_ANONYMOUSLY }
this line is what cause your issue. This tells to symfony2 security system that every user can access everything (this is the "very first rule" if you ignore the FOS ones) and so, when this is satified, no other controll will be done (as - { path: ^/OSC/dashboard, role: ROLE_USER} came after)
Possibile solutions:
1) Place that line at the bottom of your acl.
PRO: your application will work
CONS: if you don't properly set all ACL, you'll run into "security" issues or some unauthorized users could access pages that, into your logic, they have not to access.
2) Remove that line at all
PRO: your application will not suffer from security issues and unauthorized access
CONS: you have to set all route explicitly and properly, but this is pretty "natural" if you want to build a strong application

Answer 2

The reason you're getting through is because there isn't a firewall for /dashboard, but (assuming you're trying to setup SonataAdminBundle) that's not what you're supposed to have in access_control
Here's how mine looks for Sonata:
access_control:
- { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/login-check$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, role: ROLE_ADMIN }
- { path: ^/.*, role: [IS_AUTHENTICATED_ANONYMOUSLY] }
Your firewall definition is fine otherwise.
If you're trying to configure you're own custom dashboard, then you need to define another firewall entry, very similar to the admin firewall.
EDIT:
Try changing pattern to: ^/.*
If you want to block just /OSC then: /OSC(.*)