Question

I have two apps: frontend and backend, both require different credentials for one to be able to get access to the app, meaning that the security.yml files have the following form:

prod:
  default:
    is_secure: true
  all:
    is_secure: true
    credentials: student

dev:
  default:
    is_secure: true
  all:
    is_secure: true
    credentials: student

And the other yml file (backend) has exactly the same code, but for the credential being teacher instead.

This however does not work, and I can bypass the credentials and access both my apps without having to log in.

What does work is :

default: 
  is_secure: true 

all: 
  is_secure: true 
  credentials: student

Meaning, if I do not specify the environments and simply have a standard yml file, then it works as it ought to.

Not so sure what’s going wrong here, any suggestions over this are most welcome

Answer 1

You can’t configure security on environment basis.

The security is related to an app, a module or an action.

But this question has already an answer here.