buckets/config/packages/security.yaml

security:
  # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
  password_hashers:
    Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

  # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
  providers:
    # used to reload user from session & other features (e.g. switch_user)
    app_user_provider:
      entity:
        class: App\Entity\User
        property: email

  firewalls:
    dev:
      # Ensure dev tools and static assets are always allowed
      pattern: ^/(_profiler|_wdt|assets|build)/
      security: false
    main:
      lazy: true
      provider: app_user_provider
      json_login:
        check_path: api_login
      logout:
        path: /api/logout

  access_control:
    - {path: ^/api/me, roles: ROLE_USER}

when@test:
  security:
    password_hashers:
      # Password hashers are resource-intensive by design to ensure security.
      # In tests, it's safe to reduce their cost to improve performance.
      Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
        algorithm: auto
        cost: 4 # Lowest possible value for bcrypt
        time_cost: 3 # Lowest possible value for argon
        memory_cost: 10 # Lowest possible value for argon