{"record":{"id":"229cf66b3c6b2ced","repo":"symfony/symfony","slug":"the-check-path-s-for-login-method-s-is-not-m","errorCode":null,"errorMessage":"The check_path \"%s\" for login method \"%s\" is not matched by the firewall pattern \"%s\".","messagePattern":"The check_path \"(.+?)\" for login method \"(.+?)\" is not matched by the firewall pattern \"(.+?)\"\\.","errorType":"exception","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php","lineNumber":328,"sourceCode":"                $abstractFactoryKeys[] = $name;\n            }\n\n            $factory->addConfiguration($factoryNode);\n        }\n\n        // check for unreachable check paths\n        $firewallNodeBuilder\n            ->end()\n            ->validate()\n                ->ifTrue(static fn ($v) => true === $v['security'] && isset($v['pattern']) && !isset($v['request_matcher']))\n                ->then(static function ($firewall) use ($abstractFactoryKeys) {\n                    foreach ($abstractFactoryKeys as $k) {\n                        if (!isset($firewall[$k]['check_path'])) {\n                            continue;\n                        }\n\n                        if (str_contains($firewall[$k]['check_path'], '/') && !preg_match('#'.$firewall['pattern'].'#', $firewall[$k]['check_path'])) {\n                            throw new \\LogicException(\\sprintf('The check_path \"%s\" for login method \"%s\" is not matched by the firewall pattern \"%s\".', $firewall[$k]['check_path'], $k, $firewall['pattern']));\n                        }\n                    }\n\n                    return $firewall;\n                })\n            ->end()\n        ;\n    }\n\n    private function addProvidersSection(ArrayNodeDefinition $rootNode): void\n    {\n        $providerNodeBuilder = $rootNode\n            ->children()\n                ->arrayNode('providers', 'provider')\n                    ->example([\n                        'my_memory_provider' => [\n                            'memory' => [\n                                'users' => [","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php#L310-L346","documentation":"Thrown during security config validation (MainConfiguration firewall node validator) when a login method's check_path contains '/' (i.e. is a real path, not just a route name) but does not match the firewall's own pattern regex. The bundle rejects unreachable check paths so logins cannot silently hit a different (or no) firewall.","triggerScenarios":"Configuring a firewall with a `pattern` (regex) and a login method (form_login, json_login, custom authenticator) whose `check_path` is a URL path containing '/' that is not matched by that pattern. E.g. firewall pattern `^/admin` with form_login check_path `/login_check`.","commonSituations":"Splitting login across firewalls and putting the login handler path under the wrong firewall; tightening a firewall pattern without updating check_path; check_path as a path while the firewall pattern excludes it; copying config between firewalls and forgetting to align paths.","solutions":["Move the check_path under the firewall pattern: e.g. set check_path to /admin/login_check when pattern is ^/admin.","Or broaden the firewall pattern so it matches the existing check_path.","If check_path should be a route name rather than a literal path, confirm the route name has no '/' (route names without '/' are not matched against the pattern).","Re-run cache:clear / config:dump-reference security to confirm validation passes."],"exampleFix":"# before\nsecurity:\n    firewalls:\n        admin:\n            pattern: ^/admin\n            form_login:\n                check_path: /login_check   # not under /admin -> LogicException\n\n# after\nsecurity:\n    firewalls:\n        admin:\n            pattern: ^/admin\n            form_login:\n                check_path: /admin/login_check","handlingStrategy":"validation","validationCode":"// Before compiling, validate each check_path against its firewall pattern\nforeach ($firewalls as $name => $fw) {\n    if (!empty($fw['pattern']) && !empty($fw['form_login']['check_path'])) {\n        $cp = $fw['form_login']['check_path'];\n        if (str_contains($cp, '/') && !preg_match('#' . $fw['pattern'] . '#', $cp)) {\n            throw new \\LogicException(\"check_path '$cp' not matched by firewall '$name' pattern '{$fw['pattern']}'\");\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep each login method's check_path under its firewall pattern.","Use route names (without '/') for check_path to bypass pattern matching when appropriate.","Run config:dump-reference or cache:clear to validate security config in CI.","When splitting firewalls, plan which paths each owns, including login handlers."],"tags":["security","configuration","firewall","validation","authentication"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}