I have a problem with the access_control configuration on a Symfony 6.4 project.

The custom_authenticator I defined does not seem to take the access_control entries into account.

Indeed, all the routes in the project are subject to this authentication.

The routes seem to be correctly defined because when using another firewall (e.g form_login), everything works correctly.

Here is the security.yml file.

security:
password_hashers:
SymfonyComponentSecurityCoreUserPasswordAuthenticatedUserInterface: ‘auto’

providers:
    app_user_provider:
        id: AppSecurityUserProvider

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false
    main:
        lazy: true
        logout:
            path: app_logout

    # this authenticator forces the user to be logged in for every page (even the ones declared as public in access_control)
       # custom_authenticators:
       #    - AppSecurityCustomAuthenticator

    # this one works fine
        form_login:
            login_path: app_login
            check_path: app_login


access_control:
    - { path: ^/$, roles: PUBLIC_ACCESS }
    

What I what to achieve is :

• when an anonymous user access / => display the page
• when a logged-in user try to access / , he should be redirected.

This means I need to know if he’s logged in or not (so an exception in the firewall is not a solution)

I created a dummy projet in github to reproduce the problem (https://github.com/mattbild/sf-issue) .

Thanks to anyone who can give me a hand because I can’t see what the issue is.