symfony/symfony · error · LogicException

The check_path "%s" for login method "%s" is not matched by

Error message

The check_path "%s" for login method "%s" is not matched by the firewall pattern "%s".

What it means

Thrown during security config validation (MainConfiguration firewall node validator) when a login method's check_path contains '/' (i.e. is a real path, not just a route name) but does not match the firewall's own pattern regex. The bundle rejects unreachable check paths so logins cannot silently hit a different (or no) firewall.

Source

Thrown at src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php:328

                $abstractFactoryKeys[] = $name;
            }

            $factory->addConfiguration($factoryNode);
        }

        // check for unreachable check paths
        $firewallNodeBuilder
            ->end()
            ->validate()
                ->ifTrue(static fn ($v) => true === $v['security'] && isset($v['pattern']) && !isset($v['request_matcher']))
                ->then(static function ($firewall) use ($abstractFactoryKeys) {
                    foreach ($abstractFactoryKeys as $k) {
                        if (!isset($firewall[$k]['check_path'])) {
                            continue;
                        }

                        if (str_contains($firewall[$k]['check_path'], '/') && !preg_match('#'.$firewall['pattern'].'#', $firewall[$k]['check_path'])) {
                            throw new \LogicException(\sprintf('The check_path "%s" for login method "%s" is not matched by the firewall pattern "%s".', $firewall[$k]['check_path'], $k, $firewall['pattern']));
                        }
                    }

                    return $firewall;
                })
            ->end()
        ;
    }

    private function addProvidersSection(ArrayNodeDefinition $rootNode): void
    {
        $providerNodeBuilder = $rootNode
            ->children()
                ->arrayNode('providers', 'provider')
                    ->example([
                        'my_memory_provider' => [
                            'memory' => [
                                'users' => [

View on GitHub (pinned to 698e28026c)

Solutions

Move the check_path under the firewall pattern: e.g. set check_path to /admin/login_check when pattern is ^/admin.
Or broaden the firewall pattern so it matches the existing check_path.
If check_path should be a route name rather than a literal path, confirm the route name has no '/' (route names without '/' are not matched against the pattern).
Re-run cache:clear / config:dump-reference security to confirm validation passes.

Example fix

# before
security:
    firewalls:
        admin:
            pattern: ^/admin
            form_login:
                check_path: /login_check   # not under /admin -> LogicException

# after
security:
    firewalls:
        admin:
            pattern: ^/admin
            form_login:
                check_path: /admin/login_check

Defensive patterns

Strategy: validation

Validate before calling

// Before compiling, validate each check_path against its firewall pattern
foreach ($firewalls as $name => $fw) {
    if (!empty($fw['pattern']) && !empty($fw['form_login']['check_path'])) {
        $cp = $fw['form_login']['check_path'];
        if (str_contains($cp, '/') && !preg_match('#' . $fw['pattern'] . '#', $cp)) {
            throw new \LogicException("check_path '$cp' not matched by firewall '$name' pattern '{$fw['pattern']}'");
        }
    }
}

Prevention

Keep each login method's check_path under its firewall pattern.
Use route names (without '/') for check_path to bypass pattern matching when appropriate.
Run config:dump-reference or cache:clear to validate security config in CI.
When splitting firewalls, plan which paths each owns, including login handlers.

When it happens

Trigger: Configuring a firewall with a `pattern` (regex) and a login method (form_login, json_login, custom authenticator) whose `check_path` is a URL path containing '/' that is not matched by that pattern. E.g. firewall pattern `^/admin` with form_login check_path `/login_check`.

Common situations: Splitting login across firewalls and putting the login handler path under the wrong firewall; tightening a firewall pattern without updating check_path; check_path as a path while the firewall pattern excludes it; copying config between firewalls and forgetting to align paths.

Related errors

AI-assisted analysis of symfony/symfony@698e28026c (2026-08-06). Data as JSON: /api/errors/229cf66b3c6b2ced. Report an issue: GitHub.