This is the homepage of our Website Vulnerability Scanner Tool that identifies Broken Access Control vulnerabilities in seconds.

🛠️ Symfony Code Example: Route Access Not Protected

Let’s look at a simple Symfony route that lacks proper access control.

// src/Controller/AdminController.php

namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;

use Symfony\Component\HttpFoundation\Response;

use Symfony\Component\Routing\Annotation\Route;

class AdminController extends AbstractController

{

    /**

     * @Route("/admin", name="admin_dashboard")

     */

    public function index(): Response

    {

        return new Response('Welcome to the admin dashboard!');

    }

}

❌ What’s wrong here?

Anyone who knows the /admin URL can access it. There is no check for roles or user permissions.

✅ Fix: Restrict Access with @IsGranted

Use Symfony’s built-in access control to protect routes.

use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted;

/**

 * @Route("/admin", name="admin_dashboard")

 * @IsGranted("ROLE_ADMIN")

 */

public function index(): Response

{

    return new Response('Welcome to the admin dashboard!');

}

Or enforce it inside the controller:

public function index(): Response

{

    $this->denyAccessUnlessGranted('ROLE_ADMIN');

    return new Response('Welcome to the admin dashboard!');

}

🧪 Example: Insecure Object Access

Let's say we have a blog platform and users can view their posts like this:

/**

 * @Route("/post/{id}", name="view_post")

 */

public function view(Post $post): Response

{

    return $this->render('post/view.html.twig', [

        'post' => $post,

    ]);

}

If there’s no access check, one user can view another user’s post by guessing the post ID.

✅ Fix: Enforce Ownership

public function view(Post $post): Response

{

    if ($post->getUser() !== $this->getUser()) {

        throw $this->createAccessDeniedException();

    }

    return $this->render('post/view.html.twig', [

        'post' => $post,

    ]);

}

🔐 Security Config Best Practice

Another place access control should be enforced is in security.yaml.

access_control:

    - { path: ^/admin, roles: ROLE_ADMIN }

    - { path: ^/user, roles: ROLE_USER }

🧑‍💻 Screenshot: Website Vulnerability Assessment Report