Symfony IP Access Control Configuration Not Working - symfony

Question

We need to restrict part of our application by IP, even though there is other authentication going on. Belt and braces.
The Symfony docs say that this should work...
- { path: ^/api/whatever, role: [ROLE_WHATEVER_API], ips: [ 1.2.3.4, 5.6.7.8 ] }
... but this seems to break the access control altogether and all requests get through.
So we have used an expression instead, which works, but is ugly and once we have a list of 5 or so IPs is just and unwieldy mess...
- { path: ^/api/whatever, allow_if: "('1.2.3.4' == request.getClientIp() or '5.6.7.8' == request.getClientIp()) and has_role('ROLE_WHATEVER_API')" }
Anyone got any ideas why the nice clean method suggested by the docs (http://symfony.com/doc/current/cookbook/security/access_control.html#matching-access-control-by-ip) does not work?

Answer 1

You may want to read the docs again.
IP in access control works, it just does not work the way your "allow_if" expression does.
If you want it to restrict IP's that are not 1.2.3.4 and 5.6.7.8, do as follows :
- { path: ^/api/whatever, role: [ROLE_WHATEVER_API], ips: [ 1.2.3.4, 5.6.7.8 ] }
- { path: ^/api/whatever, role: [ROLE_NO_ACCESS] }
This is covered here.

Answer 2

Your access rule will only match for specified IPs. It means that Symfony will continue matching next rules, and will conclude user is allowed to call the path, if none of the paths rejected it.
You need to explicitly forbid access for others with a second rule:
- { path: ^/api/whatever, role: [ROLE_WHATEVER_API], ips: [ 1.2.3.4, 5.6.7.8 ] }
- { path: ^/api/whatever, role: [ROLE_NO_ACCESS]}
It is explained in the docs you referenced.