<p dir="auto">Take this <code class="notranslate">parameters.yml</code>:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="router.request_context.host: my.domain.com
domain: my.domain.com"><pre class="notranslate"><span class="pl-ent">router.request_context.host</span>: <span class="pl-s">my.domain.com</span>
<span class="pl-ent">domain</span>: <span class="pl-s">my.domain.com</span></pre></div>
<p dir="auto">When using <code class="notranslate">%domain%</code> it in <code class="notranslate">security.yml</code>, i.e. in the access control section:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="firewalls:
    admin:
        host: ^admin\.
# ...
access_control:
  - { host: admin.%domain%, path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
  - { host: admin.%domain%, path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }"><pre class="notranslate"><span class="pl-ent">firewalls</span>:
    <span class="pl-ent">admin</span>:
        <span class="pl-ent">host</span>: <span class="pl-s">^admin\.</span>
<span class="pl-c"><span class="pl-c">#</span> ...</span>
<span class="pl-ent">access_control</span>:
  - <span class="pl-s">{ host: admin.%domain%, path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }</span>
  - <span class="pl-s">{ host: admin.%domain%, path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }</span></pre></div>
<p dir="auto">All works as expected. Relevant section in generated <code class="notranslate">appProdProjectContainer.php</code> (returns added for redability):</p>
<div class="highlight highlight-text-html-php notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="protected function getSecurity_Firewall_Map_Context_AdminService()
{
    // ...
    $h = new \Symfony\Component\HttpFoundation\RequestMatcher(
        '^/login$', 'admin.my.domain.com' // correct
    );
    $i = new \Symfony\Component\HttpFoundation\RequestMatcher(
        '^/', 'admin.my.domain.com' // correct
    );
    $j = new \Symfony\Component\Security\Http\AccessMap();
   // ...
}"><pre class="notranslate"><span class="pl-k">protected</span> <span class="pl-k">function</span> <span class="pl-en">getSecurity_Firewall_Map_Context_AdminService</span>()
{
    <span class="pl-c">// ...</span>
    <span class="pl-s1"><span class="pl-c1">$</span>h</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">HttpFoundation</span>\<span class="pl-v">RequestMatcher</span>(
        <span class="pl-s">'^/login$'</span>, <span class="pl-s">'admin.my.domain.com'</span> <span class="pl-c">// correct</span>
    );
    <span class="pl-s1"><span class="pl-c1">$</span>i</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">HttpFoundation</span>\<span class="pl-v">RequestMatcher</span>(
        <span class="pl-s">'^/'</span>, <span class="pl-s">'admin.my.domain.com'</span> <span class="pl-c">// correct</span>
    );
    <span class="pl-s1"><span class="pl-c1">$</span>j</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">Security</span>\<span class="pl-v">Http</span>\<span class="pl-v">AccessMap</span>();
   <span class="pl-c">// ...</span>
}</pre></div>
<p dir="auto">However using <code class="notranslate">%router.request_context.host%</code>, for some reason, it get's translated into <code class="notranslate">localhost</code>, that is your firewall would not apply to production sites (doesn't match):</p>
<div class="highlight highlight-text-html-php notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="protected function getSecurity_Firewall_Map_Context_AdminService()
{
    // ...
    $h = new \Symfony\Component\HttpFoundation\RequestMatcher(
        '^/login$', 'admin.localhost' // wrong
    );
    $i = new \Symfony\Component\HttpFoundation\RequestMatcher(
        '^/', 'admin.localhost' // everyone accessing admin in prod!
    );
    $j = new \Symfony\Component\Security\Http\AccessMap();
   // ...
}"><pre class="notranslate"><span class="pl-k">protected</span> <span class="pl-k">function</span> <span class="pl-en">getSecurity_Firewall_Map_Context_AdminService</span>()
{
    <span class="pl-c">// ...</span>
    <span class="pl-s1"><span class="pl-c1">$</span>h</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">HttpFoundation</span>\<span class="pl-v">RequestMatcher</span>(
        <span class="pl-s">'^/login$'</span>, <span class="pl-s">'admin.localhost'</span> <span class="pl-c">// wrong</span>
    );
    <span class="pl-s1"><span class="pl-c1">$</span>i</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">HttpFoundation</span>\<span class="pl-v">RequestMatcher</span>(
        <span class="pl-s">'^/'</span>, <span class="pl-s">'admin.localhost'</span> <span class="pl-c">// everyone accessing admin in prod!</span>
    );
    <span class="pl-s1"><span class="pl-c1">$</span>j</span> = <span class="pl-k">new</span> \<span class="pl-v">Symfony</span>\<span class="pl-v">Component</span>\<span class="pl-v">Security</span>\<span class="pl-v">Http</span>\<span class="pl-v">AccessMap</span>();
   <span class="pl-c">// ...</span>
}</pre></div>
<p dir="auto">As <code class="notranslate">%router.request_context.host%</code> is the suggested method for configuring the request context globally (i.e sending mails with generated URLs) I think this could lead to insecure applications.</p>
<p dir="auto">A solution:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="domain: my.domain.com
router.request_context.host: %domain%"><pre class="notranslate"><code class="notranslate">domain: my.domain.com
router.request_context.host: %domain%
</code></pre></div>
<p dir="auto">I trying to use third-party bundle. (<a href="http://knpbundles.com/ornicar/ApcBundle" rel="nofollow">http://knpbundles.com/ornicar/ApcBundle</a>). This bundle requires me to provide <code class="notranslate">ornicar_apc.host</code> config value. I am trying to re-use existing configuration value <code class="notranslate">router.request_context.host</code>, which is overrided in my <code class="notranslate">parameters.yml</code>, but third-party bundle always compiled with default configuration value <code class="notranslate">localhost</code>. After some time of debugging I found:</p>
<p dir="auto">1st step: <a href="https://github.com/symfony/symfony/blob/master/src/Symfony/Component/DependencyInjection/Compiler/MergeExtensionConfigurationPass.php#L50">https://github.com/symfony/symfony/blob/master/src/Symfony/Component/DependencyInjection/Compiler/MergeExtensionConfigurationPass.php#L50</a> loading configuration for the <code class="notranslate">framework</code> extension. Keep in mind: <code class="notranslate">$container</code> already have loaded valid value for <code class="notranslate">router.request_context.host</code>.</p>
<p dir="auto">2nd step: This line: <a href="https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php#L306">https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php#L306</a> loads default config value for <code class="notranslate">router.request_context.host</code> parameter value and rewriting existing "normal" value.</p>
<p dir="auto">3rd step: Thrd-party bundle uses overwriten value of <code class="notranslate">router.request_context.host</code> parameter.</p>
<p dir="auto">Could you help me with resolving this bug?</p>