Challenge 2 / 2

Our new /impersonate route has no controller and no access_control rule. So what stops any logged-in user from posting to it and switching to Captain Picard?

Symfony only allows impersonation from pages under /admin

The CSRF token can only be generated for admins

The switch-user listener checks the role from our switch_user config, CAN_IMPERSONATE, before switching

Nothing - we need to add an access_control rule for ^/impersonate

Rewatch the video