security: enable_authenticator_manager: true # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords password_hashers: app_hasher: # the service ID of your custom hasher (the FQCN using the default services.yaml) id: 'App\Security\Hasher\PasswordEncoder' # App\Entity\User: 'sha256' # Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: # algorithm: 'sha256' # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider providers: sql_login_provider: id: App\Security\SQLLoginUserProvider firewalls: dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false main: # lazy: true stateless: false provider: sql_login_provider custom_authenticators: - App\Security\SQLLoginUserAuthenticator entry_point: form_login form_login: login_path: app_login check_path: app_login username_parameter: login password_parameter: password enable_csrf: true login_throttling: max_attempts: 3 logout: true # activate different ways to authenticate # https://symfony.com/doc/current/security.html#the-firewall # https://symfony.com/doc/current/security/impersonating_user.html # switch_user: true # Easy way to control access for large sections of your site # Note: Only the *first* access control that matches will be used access_control: - { path: ^/login, roles: PUBLIC_ACCESS } - { path: ^/connect, roles: ROLE_USER } # - { path: ^/connect, roles: [IS_AUTHENTICATED_FULLY, ROLE_USER] } when@test: security: password_hashers: # By default, password hashers are resource intensive and take time. This is # important to generate secure password hashes. In tests however, secure hashes # are not important, waste resources and increase test times. The following # reduces the work factor to the lowest possible values. Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: algorithm: auto cost: 4 # Lowest possible value for bcrypt time_cost: 3 # Lowest possible value for argon memory_cost: 10 # Lowest possible value for argon