[Security] Simplifying the DEV firewall's pattern

[ThomasLandauer]

Page: https://symfony.com/doc/6.4/security.html#the-firewall

Reasons:

• The inner parentheses _(profiler|wdt) are overly complicated
• AssetMapper recommends to have all assets under /assets/: https://symfony.com/doc/6.4/frontend/asset_mapper.html

Question:
Shouldn't this dev firewall be loaded in DEV environment only? (i.e. under something like when@dev)

[xabbuh]

IIRC we have it this way to be in line with the recipe: https://github.com/symfony/recipes/blob/main/symfony/security-bundle/6.4/config/packages/security.yaml#L10

[ThomasLandauer]

Well, then let's change it there too :-) symfony/recipes#1395

[xabbuh]

Question:
Shouldn't this dev firewall be loaded in DEV environment only? (i.e. under something like when@dev)

The security config is not merged between environments. So you would have to repeat everything for the dev environment.

[ThomasLandauer]

Is this true for all parts of the config?
Cause at https://symfony.com/doc/current/security/passwords.html#configuring-a-password-hasher (green box) it's recommended to reconfigure the password hasher in config/packages/test/security.php, and I did this in config/packages/security.php like this:

if ('test' === $containerConfigurator->env()) {
    // ...
}

[wouterj]

Is this true for all parts of the config?

Not to all parts, and some parts behave differently. We don't merge configuration from security.role_hierarchy and security.password_hashers, and we don't allow new items in security.firewalls (i.e. you may change options of the firewalls, but you can't add new firewalls).

---

About this PR, I think it makes sense, but let's wait for the recipe to be accepted as the documentation have to be in sync with the generated recipes.

[xabbuh]

Suggested change

	pattern: ^/_profiler|_wdt|assets|build/ # `assets` is for AssetMapper; `build` is for Webpack Encore
	pattern: ^/(_profiler|_wdt|assets|build)/ # `assets` is for AssetMapper; `build` is for Webpack Encore

[xabbuh]

Suggested change

	pattern="^/_profiler|_wdt|assets|build/"
	pattern="^/(_profiler|_wdt|assets|build)/"

[smnandre]

What is the problem this PR solves ? I mean, is there any real life problem with AssetMapper or Webpack ?

(even if for the first I seriously doubt it, as the dev server priority is greater than security listeners in dev and ... it does not work in prod)