@@ -74,15 +74,13 @@ Authorization (i.e. Denying Access)
7474-----------------------------------
7575
7676Symfony gives you several ways to enforce authorization, including the ``access_control ``
77- configuration in:doc: `security.yml </reference/configuration/security >`, the
78- :ref: `@Security annotation <best-practices-security-annotation >` and using
79- :ref: `isGranted <best-practices-directly-isGranted >` on the ``security.context ``
77+ configuration in:doc: `security.yml </reference/configuration/security >` and
78+ using:ref: `isGranted <best-practices-directly-isGranted >` on the ``security.context ``
8079service directly.
8180
8281..best-practice ::
8382
8483 * For protecting broad URL patterns, use ``access_control ``;
85- * Whenever possible, use the ``@Security `` annotation;
8684 * Check security directly on the ``security.context `` service whenever
8785 you have a more complex situation.
8886
@@ -208,14 +206,13 @@ Now you can reuse this method both in the template and in the security expressio
208206 {% endif %}
209207
210208.. _best-practices-directly-isGranted :
209+ .. _checking-permissions-without-security :
211210
212- Checking Permissions without @Security
213- --------------------------------------
211+ Manually Checking Permissions
212+ -----------------------------
214213
215- The above example with ``@Security `` only works because we're using the
216- :ref: `ParamConverter <best-practices-paramconverter >`, which gives the expression
217- access to the a ``post `` variable. If you don't use this, or have some other
218- more advanced use-case, you can always do the same security check in PHP:
214+ If you cannot control the access based on URL patterns, you can always do
215+ the security checks in PHP:
219216
220217..code-block ::php
221218
@@ -303,21 +300,7 @@ To enable the security voter in the application, define a new service:
303300tags :
304301 -{ name: security.voter }
305302
306- @Security `` annotation:
307-
308- ..code-block ::php
309-
310- /**
311- * @Route("/{id}/edit", name="admin_post_edit")
312- * @Security("is_granted('edit', post)")
313- */
314- public function editAction(Post $post)
315- {
316- // ...
317- }
318-
319- security.context `` service or via
320- the even easier shortcut in a controller:
303+ security.context `` service:
321304
322305..code-block ::php
323306