{"record":{"id":"eb6c563dbbcd7d5a","repo":"symfony/symfony","slug":"one-or-more-access-control-items-are-empty-did-yo","errorCode":null,"errorMessage":"One or more access control items are empty. Did you accidentally add lines only containing a \"-\" under \"security.access_control\"?","messagePattern":"One or more access control items are empty\\. Did you accidentally add lines only containing a \"-\" under \"security\\.access_control\"\\?","errorType":"validation","errorClass":"InvalidConfigurationException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php","lineNumber":259,"sourceCode":"                    $container,\n                    $access['path'],\n                    $access['host'],\n                    $access['port'],\n                    $access['methods'],\n                    $access['ips'],\n                    $attributes\n                );\n            }\n\n            $roles = $access['roles'];\n            if ($access['allow_if']) {\n                $roles[] = $this->createExpression($container, $access['allow_if']);\n            }\n\n            $emptyAccess = 0 === \\count(array_filter($access));\n\n            if ($emptyAccess) {\n                throw new InvalidConfigurationException('One or more access control items are empty. Did you accidentally add lines only containing a \"-\" under \"security.access_control\"?');\n            }\n\n            $container->getDefinition('security.access_map')\n                      ->addMethodCall('add', [$matcher, $roles, $access['requires_channel']]);\n        }\n\n        // allow cache warm-up for expressions\n        if (\\count($this->expressions)) {\n            $container->getDefinition('security.cache_warmer.expression')\n                ->replaceArgument(0, new IteratorArgument(array_values($this->expressions)));\n        } else {\n            $container->removeDefinition('security.cache_warmer.expression');\n        }\n    }\n\n    private function createFirewalls(array $config, ContainerBuilder $container): void\n    {\n        if (!isset($config['firewalls'])) {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php#L241-L277","documentation":"createAuthorization() applies array_filter to each access_control entry; if every field is empty/falsy it throws. This detects YAML stray dashes — a line containing only '-' under access_control resolves to an array of all-default (empty) values.","triggerScenarios":"Having a bare '-' line under security.access_control, or an entry that resolves to all empty/default values.","commonSituations":"YAML formatting slip — a trailing dash left after deleting an entry's content; indentation error.","solutions":["Remove the stray/empty '-' line from access_control.","Ensure each access_control entry has at least one matching constraint (path, host, request_matcher, etc.) and roles."],"exampleFix":"# before\nsecurity:\n  access_control:\n    - { path: ^/admin, roles: ROLE_ADMIN }\n    -\n# after\nsecurity:\n  access_control:\n    - { path: ^/admin, roles: ROLE_ADMIN }","handlingStrategy":"validation","validationCode":"foreach ($accessControl as $entry) {\n    if (0 === count(array_filter($entry))) {\n        throw new \\InvalidArgumentException('Empty access_control entry detected — likely a stray \"-\" in YAML.');\n    }\n}","typeGuard":"function accessControlEntryIsNonEmpty(array $entry): bool\n{\n    return count(array_filter($entry)) > 0;\n}","tryCatchPattern":null,"preventionTips":["After deleting an access_control entry, remove the whole '- { ... }' line, not just its content.","Run lint:container in CI to catch YAML structural mistakes."],"tags":["security","configuration","access-control","yaml"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}