Block access to a system URL or folder path

Question

Hi, I’m looking to block access to the administrative part of my site and release to only a few ips. I can do this using the .htacess well quiet but the problem is that I have the module Adminstrativa and the frontend module and the .htaccess of the web folder blocks the whole system and not only the administrative one. I wanted to know how to make it block access by the url or the admin folder. I tried to use the .htaccess and the .htpasswd in the login folder but not rolled.

Someone who’s been through this has some idea?

Answer 1

With the directive access_control Symfony’s security configuration is quite easy to do this.

See some examples in that article from Symfony’s own website:

security:
    # ...
    access_control:
        - { path: ^/admin, roles: ROLE_USER_IP, ip: 127.0.0.1 }
        - { path: ^/admin, roles: ROLE_USER_HOST, host: symfony\.com$ }
        - { path: ^/admin, roles: ROLE_USER_METHOD, methods: [POST, PUT] }
        - { path: ^/admin, roles: ROLE_USER }

At each of the entries of the Directive access_control it is possible to insert four settings:

• path (defining by which route the administrative part is accessible)
• ip or ips (defining which Ips have access to the administrative part)
• host (defining through which host the administrative part is accessible)
• methods (defining the methods permitted in the administrative part)

You can also put an expression through the directive allow_if (for example, allow_if: "'127.0.0.1' == request.getClientIp() or has_role('ROLE_ADMIN')") and even force access to the administrative section to be done through HTTPS (using requires_channel: https).