在security.yaml中限制HTTP方法不起作用(Symfony，LexikJwk)

Question

我试图只允许注册(POST方法)一个新用户(路由:/api/users)，我试图遵循文档(https://symfony.com/doc/current/security/firewall_restriction.html#restricting-by-http-methods)，但是当我用Postman测试时，我仍然设法看到所有用户使用GET方法。的安全。html文件:

security:
# https://symfony.com/doc/current/security/authenticator_manager.html
enable_authenticator_manager: true
# https://symfony.com/doc/current/security.html#c-hashing-passwords
password_hashers:
SymfonyComponentSecurityCoreUserPasswordAuthenticatedUserInterface: 'auto'
AppEntityUser:
algorithm: auto
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
providers:
# used to reload user from session & other features (e.g. switch_user)
app_user_provider:
entity:
class: AppEntityUser
property: email
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
registration:
pattern: ^/api/users
stateless: true
methods: [POST]
login:
pattern: ^/api/login
stateless: true
json_login:
check_path: /api/login_check
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
api:
pattern:   ^/api
stateless: true
jwt: ~
main:
lazy: true
provider: app_user_provider
# activate different ways to authenticate
# https://symfony.com/doc/current/security.html#firewalls-authentication
# https://symfony.com/doc/current/security/impersonating_user.html
# switch_user: true
# Easy way to control access for large sections of your site
# Note: Only the *first* access control that matches will be used
# access_control:
#     - { path: ^/api/login, roles: PUBLIC_ACCESS }
#     - { path: ^/api,       roles: IS_AUTHENTICATED_FULLY }

短版:

firewalls:
registration:
pattern: ^/api/users
stateless: true
methods: [POST]

当尝试使用GET方法访问/api/users时，我应该看到的是代码401，"未找到JWT令牌"。但是我没有，我看到了用户和他们的数据。

Answer 1

我必须在最后的访问控制中配置它:

access_control:
- { path: ^/api/users, roles: IS_AUTHENTICATED_FULLY, methods: [GET, PUT, DELETE] }