From 5c554913b06ac463e62c0b1f89e7f563462e7cc0 Mon Sep 17 00:00:00 2001 From: Christian Flothmann Date: Sat, 17 Jan 2015 11:12:12 +0100 Subject: [PATCH] fix merge after removing @Security in 2.3 --- best_practices/security.rst | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/best_practices/security.rst b/best_practices/security.rst index d5ce51deb31..5718e776e86 100644 --- a/best_practices/security.rst +++ b/best_practices/security.rst @@ -74,13 +74,15 @@ Authorization (i.e. Denying Access) ----------------------------------- Symfony gives you several ways to enforce authorization, including the ``access_control`` -configuration in :doc:`security.yml ` and -using :ref:`isGranted ` on the ``security.context`` +configuration in :doc:`security.yml `, the +:ref:`@Security annotation ` and using +:ref:`isGranted ` on the ``security.context`` service directly. .. best-practice:: * For protecting broad URL patterns, use ``access_control``; + * Whenever possible, use the ``@Security`` annotation; * Check security directly on the ``security.context`` service whenever you have a more complex situation. @@ -207,9 +209,10 @@ Now you can reuse this method both in the template and in the security expressio .. _best-practices-directly-isGranted: .. _checking-permissions-without-security: +.. _manually-checking-permissions: -Manually Checking Permissions ------------------------------ +Checking Permissions without @Security +-------------------------------------- The above example with ``@Security`` only works because we're using the :ref:`ParamConverter `, which gives the expression