From 32c9c3f8c749a7f4ab2ece47a84874744a19a907 Mon Sep 17 00:00:00 2001
From: Marijn Doeve <marijn@doeve.me>
Date: Thu, 5 Feb 2026 22:10:47 +0100
Subject: [PATCH] symfony/security recipe

---
 config/packages/security.yaml | 14 ++++++--------
 symfony.lock                  |  6 +++---
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index 625c05c..5902804 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -2,6 +2,7 @@ security:
     # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
     password_hashers:
         Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
+
     # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
     providers:
         # used to reload user from session & other features (e.g. switch_user)
@@ -12,7 +13,8 @@ security:
         # used to reload user from session & other features (e.g. switch_user)
     firewalls:
         dev:
-            pattern: ^/(_(profiler|wdt)|css|images|js)/
+            # Ensure dev tools and static assets are always allowed
+            pattern: ^/(_profiler|_wdt|assets|build)/
             security: false
         main:
             lazy: true
@@ -29,12 +31,10 @@ security:
             
             # activate different ways to authenticate
             # https://symfony.com/doc/current/security.html#the-firewall
-            
+
             # https://symfony.com/doc/current/security/impersonating_user.html
             # switch_user: true
     
-    # Easy way to control access for large sections of your site
-    # Note: Only the *first* access control that matches will be used
     access_control:
         - { path: ^/admin, roles: ROLE_ADMIN }
         - { path: ^/backoffice, roles: ROLE_USER }
@@ -42,10 +42,8 @@ security:
 when@test:
     security:
         password_hashers:
-            # By default, password hashers are resource intensive and take time. This is
-            # important to generate secure password hashes. In tests however, secure hashes
-            # are not important, waste resources and increase test times. The following
-            # reduces the work factor to the lowest possible values.
+            # Password hashers are resource-intensive by design to ensure security.
+            # In tests, it's safe to reduce their cost to improve performance.
             Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                 algorithm: auto
                 cost: 4 # Lowest possible value for bcrypt
diff --git a/symfony.lock b/symfony.lock
index 9599948..bda13dd 100644
--- a/symfony.lock
+++ b/symfony.lock
@@ -260,12 +260,12 @@
         ]
     },
     "symfony/security-bundle": {
-        "version": "7.2",
+        "version": "8.0",
         "recipe": {
             "repo": "github.com/symfony/recipes",
             "branch": "main",
-            "version": "6.4",
-            "ref": "2ae08430db28c8eb4476605894296c82a642028f"
+            "version": "7.4",
+            "ref": "c42fee7802181cdd50f61b8622715829f5d2335c"
         },
         "files": [
             "config/packages/security.yaml",