security:
  encoders:
    # this internal class is used by Symfony to represent in-memory users
    Symfony\Component\Security\Core\User\User: 'auto'
  # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
  providers:
    # used to reload user from session & other features (e.g. switch_user)
    app_instance_provider:
      id: App\Security\InstanceProvider
  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    doc:
      pattern: ^/api/doc
      security: true
      http_basic:
        realm: Secured Area
      provider: app_basic
    main:
      stateless: true
      anonymous: false
      provider: app_instance_provider
      guard:
        authenticators:
          - App\Security\InternalAuthenticator
          - App\Security\ApiHmacAuthenticator
          - App\Security\EncryptionAuthentication
