Question

In the Symfony 2 template documentation it recommends embedding a controller within a template via the render url method and provides the following example:

<div id="sidebar">
    {% render url('latest_articles', { 'max': 3 }) %}
</div>

This is fine, however is it possible to make this route only accessible to templates to prevent a user from accessing the url directly, and if so – what is the recommended way of doing it?

Answer 1

You can define all you rendered controller routes pattern as “/_render/unique_name” or prefix them with “_render” and use access_control to secure the routes from outside world:

# app/config/security.yml
security:
    access_control:
        - { path: ^/_render, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }
        - { path: ^/_render, roles: ROLE_NO_ACCESS }