symfony/symfony · error · InvalidConfigurationException

One or more access control items are empty. Did you accident

Error message

One or more access control items are empty. Did you accidentally add lines only containing a "-" under "security.access_control"?

What it means

createAuthorization() applies array_filter to each access_control entry; if every field is empty/falsy it throws. This detects YAML stray dashes — a line containing only '-' under access_control resolves to an array of all-default (empty) values.

Source

Thrown at src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php:259

                    $container,
                    $access['path'],
                    $access['host'],
                    $access['port'],
                    $access['methods'],
                    $access['ips'],
                    $attributes
                );
            }

            $roles = $access['roles'];
            if ($access['allow_if']) {
                $roles[] = $this->createExpression($container, $access['allow_if']);
            }

            $emptyAccess = 0 === \count(array_filter($access));

            if ($emptyAccess) {
                throw new InvalidConfigurationException('One or more access control items are empty. Did you accidentally add lines only containing a "-" under "security.access_control"?');
            }

            $container->getDefinition('security.access_map')
                      ->addMethodCall('add', [$matcher, $roles, $access['requires_channel']]);
        }

        // allow cache warm-up for expressions
        if (\count($this->expressions)) {
            $container->getDefinition('security.cache_warmer.expression')
                ->replaceArgument(0, new IteratorArgument(array_values($this->expressions)));
        } else {
            $container->removeDefinition('security.cache_warmer.expression');
        }
    }

    private function createFirewalls(array $config, ContainerBuilder $container): void
    {
        if (!isset($config['firewalls'])) {

View on GitHub (pinned to 698e28026c)

Solutions

Remove the stray/empty '-' line from access_control.
Ensure each access_control entry has at least one matching constraint (path, host, request_matcher, etc.) and roles.

Example fix

# before
security:
  access_control:
    - { path: ^/admin, roles: ROLE_ADMIN }
    -
# after
security:
  access_control:
    - { path: ^/admin, roles: ROLE_ADMIN }

Defensive patterns

Strategy: validation

Validate before calling

foreach ($accessControl as $entry) {
    if (0 === count(array_filter($entry))) {
        throw new \InvalidArgumentException('Empty access_control entry detected — likely a stray "-" in YAML.');
    }
}

Type guard

function accessControlEntryIsNonEmpty(array $entry): bool
{
    return count(array_filter($entry)) > 0;
}

Prevention

After deleting an access_control entry, remove the whole '- { ... }' line, not just its content.
Run lint:container in CI to catch YAML structural mistakes.

When it happens

Trigger: Having a bare '-' line under security.access_control, or an entry that resolves to all empty/default values.

Common situations: YAML formatting slip — a trailing dash left after deleting an entry's content; indentation error.

Related errors

AI-assisted analysis of symfony/symfony@698e28026c (2026-08-06). Data as JSON: /api/errors/eb6c563dbbcd7d5a. Report an issue: GitHub.