@@ -289,18 +289,33 @@ accidentally block Symfony's dev tools - which live under URLs like ``/_profiler
289289and ``/_wdt ``.
290290
291291All *real * URLs are handled by the ``main `` firewall (no ``pattern `` key means
292- it matches *all * URLs). But this does *not * mean that every URL requires authentication.
293- Nope, thanks to the ``anonymous `` key, this firewall *is * accessible anonymously.
292+ it matches *all * URLs). A firewall can have many modes of authentication,
293+ in other words many ways to ask the question "Who are you?". Often, the
294+ user is unknown (i.e. not logged in) when they first visit your website. The
295+ ``anonymous `` mode, if enabled, is used for these requests.
294296
295- In fact, if you go to the homepage right now, you *will * have access and you'll see
296- that you're "authenticated" as ``anon. ``. Don't be fooled by the "Yes" next to
297- Authenticated. The firewall verified that it does not know your identity, and so,
298- you are anonymous:
297+ In fact, if you go to the homepage right now, you *will * have access and you'll
298+ see that you're "authenticated" as ``anon. ``. The firewall verified that it
299+ does not know your identity, and so, you are anonymous:
299300
300301..image ::/_images/security/anonymous_wdt.png
301302:align: center
302303
303- You'll learn later how to deny access to certain URLs or controllers.
304+ It means any request can have an anonymous token to access some resource,
305+ while some actions (i.e. some pages or buttons) can still require specific
306+ privileges. A user can then access a form login without being authenticated
307+ as a unique user (otherwise an infinite redirection loop would happen
308+ asking the user to authenticate while trying to doing so).
309+
310+ You'll learn later how to deny access to certain URLs, controllers, or part of
311+ templates.
312+
313+ ..tip ::
314+
315+ The ``lazy `` anonymous mode prevents the session from being started if
316+ there is no need for authorization (i.e. explicit check for a user
317+ privilege). This is important to keep requests cacheable (see
318+ :doc: `/http_cache `).
304319
305320..note ::
306321