Challenge 1 / 2

You add a new firewall in config/packages/security.yaml to protect URLs that start with /admin. But after that, you notice your admin pages still behave like before. What’s the most likely reason?

Your new firewall is listed below main, and since main matches everything first, Symfony never reaches your new firewall.

Firewalls only work if you also add a matching route in config/routes/security.yaml.

Because lazy: true means security is turned off until you log in, so firewalls won’t ever run.

Firewalls can’t protect pages — only access_control can do that, so the firewall is ignored.

Rewatch the video