Symfony logout. Change target path protocol from HTTP to HTTPS

Question

My logout target path sends request by HTTP protocol. All on server works by HTTPS protocol. How to say that after logout redirect should be by HTTPS protocol?

Answer 1

There are two ways of doing this with Symfony 4.

1. Force HTTPS for an range of urls (Symfony Docs) with "requires_channel":

# config/packages/security.yaml
security:
    # ...

    access_control:
        # ...
        # catch all URLs starting with /api/user
        - { path: '^/api/user', roles: ROLE_USER, requires_channel: https }

2. Doing this for one Action as Annotation (Symfony Docs) with "schemes":

// src/Controller/SecurityController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Routing\Annotation\Route;

class SecurityController extends AbstractController
{
    /**
     * @Route("/api/user/logout-end", name="api-user-logoutEnd", schemes={"https"})
     */
    public function apiUserLogoutEnd()
    {
        // ...
    }
}

It could be that "Logout" is https, but the following site is not. Then you can apply the methods on that route, too.