<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>4.1</td>
</tr>
</tbody>
</table>
<p dir="auto">In the version 4.1 the secret parameter cannot read the global secret</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="            remember_me:
                secret:   '%env(APP_SECRET)%'"><pre class="notranslate"><code class="notranslate">            remember_me:
                secret:   '%env(APP_SECRET)%'
</code></pre></div>
<p dir="auto">or even</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="            remember_me:
                secret:   '%kernel.secret%'"><pre class="notranslate"><code class="notranslate">            remember_me:
                secret:   '%kernel.secret%'
</code></pre></div>
<p dir="auto">return the error</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="The path &quot;security.firewalls.main.remember_me.secret&quot; cannot contain an empty value, but got &quot;&quot;."><pre class="notranslate"><code class="notranslate">The path "security.firewalls.main.remember_me.secret" cannot contain an empty value, but got "".
</code></pre></div>
<p dir="auto">The same code works without trouble on 4.0</p>
<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>4.1-dev</td>
</tr>
</tbody>
</table>
<p dir="auto">Since (I suspect) <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="250085906" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/23888" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/23888/hovercard" href="https://github.com/symfony/symfony/pull/23888">#23888</a> using <code class="notranslate">env()</code> in a firewall configuration no longer works.</p>
<p dir="auto"><code class="notranslate">The path "security.firewalls.main.remember_me.secret" cannot contain an empty value, but got "".</code></p>
<details>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="In VariableNode.php line 85:

  [Symfony\Component\Config\Definition\Exception\InvalidConfigurationException]
  The path &quot;security.firewalls.main.remember_me.secret&quot; cannot contain an empty value, but got &quot;&quot;.


Exception trace:
 Symfony\Component\Config\Definition\VariableNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:402
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/PrototypedArrayNode.php:195
 Symfony\Component\Config\Definition\PrototypedArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/Processor.php:39
 Symfony\Component\Config\Definition\Processor-&gt;process() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/Processor.php:52
 Symfony\Component\Config\Definition\Processor-&gt;processConfiguration() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/Compiler/ValidateEnvPlaceholdersPass.php:80
 Symfony\Component\DependencyInjection\Compiler\ValidateEnvPlaceholdersPass-&gt;process() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/Compiler/Compiler.php:95
 Symfony\Component\DependencyInjection\Compiler\Compiler-&gt;compile() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/ContainerBuilder.php:717
 Symfony\Component\DependencyInjection\ContainerBuilder-&gt;compile() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/http-kernel/Kernel.php:513
 Symfony\Component\HttpKernel\Kernel-&gt;initializeContainer() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/http-kernel/Kernel.php:125
 Symfony\Component\HttpKernel\Kernel-&gt;boot() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/framework-bundle/Console/Application.php:65
 Symfony\Bundle\FrameworkBundle\Console\Application-&gt;doRun() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/console/Application.php:145
 Symfony\Component\Console\Application-&gt;run() at /Users/sebastiaanstok/Sites/symfony-41/my_project/bin/console:39"><pre class="notranslate"><code class="notranslate">In VariableNode.php line 85:

  [Symfony\Component\Config\Definition\Exception\InvalidConfigurationException]
  The path "security.firewalls.main.remember_me.secret" cannot contain an empty value, but got "".


Exception trace:
 Symfony\Component\Config\Definition\VariableNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:402
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/PrototypedArrayNode.php:195
 Symfony\Component\Config\Definition\PrototypedArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/ArrayNode.php:248
 Symfony\Component\Config\Definition\ArrayNode-&gt;finalizeValue() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/BaseNode.php:413
 Symfony\Component\Config\Definition\BaseNode-&gt;finalize() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/Processor.php:39
 Symfony\Component\Config\Definition\Processor-&gt;process() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/config/Definition/Processor.php:52
 Symfony\Component\Config\Definition\Processor-&gt;processConfiguration() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/Compiler/ValidateEnvPlaceholdersPass.php:80
 Symfony\Component\DependencyInjection\Compiler\ValidateEnvPlaceholdersPass-&gt;process() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/Compiler/Compiler.php:95
 Symfony\Component\DependencyInjection\Compiler\Compiler-&gt;compile() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/dependency-injection/ContainerBuilder.php:717
 Symfony\Component\DependencyInjection\ContainerBuilder-&gt;compile() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/http-kernel/Kernel.php:513
 Symfony\Component\HttpKernel\Kernel-&gt;initializeContainer() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/http-kernel/Kernel.php:125
 Symfony\Component\HttpKernel\Kernel-&gt;boot() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/framework-bundle/Console/Application.php:65
 Symfony\Bundle\FrameworkBundle\Console\Application-&gt;doRun() at /Users/sebastiaanstok/Sites/symfony-41/my_project/vendor/symfony/console/Application.php:145
 Symfony\Component\Console\Application-&gt;run() at /Users/sebastiaanstok/Sites/symfony-41/my_project/bin/console:39
</code></pre></div>
</details>
<h2 dir="auto">To reproduce:</h2>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="composer create-project symfony/website-skeleton my_project 
composer config minimum-stability dev
composer remove symfony/lts
composer update"><pre class="notranslate">composer create-project symfony/website-skeleton my_project 
composer config minimum-stability dev
composer remove symfony/lts
composer update</pre></div>
<p dir="auto">Now update config/packages/security.yaml with:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        in_memory: { memory: ~ }
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            anonymous: true

            # activate different ways to authenticate

            # http_basic: true
            # https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate

            form_login: true
            # https://symfony.com/doc/current/security/form_login_setup.html
            
            remember_me:
                secret:               '%env(APP_SECRET)%' # This used to work
                token_provider:       ~
                catch_exceptions:     true
                name:                 MAIN_REMEMBERME
                lifetime:             604800 # one week

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        # - { path: ^/admin, roles: ROLE_ADMIN }
        # - { path: ^/profile, roles: ROLE_USER }"><pre class="notranslate"><span class="pl-ent">security</span>:
    <span class="pl-c"><span class="pl-c">#</span> https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers</span>
    <span class="pl-ent">providers</span>:
        <span class="pl-ent">in_memory</span>: <span class="pl-s">{ memory: ~ }</span>
    <span class="pl-ent">firewalls</span>:
        <span class="pl-ent">dev</span>:
            <span class="pl-ent">pattern</span>: <span class="pl-s">^/(_(profiler|wdt)|css|images|js)/</span>
            <span class="pl-ent">security</span>: <span class="pl-c1">false</span>
        <span class="pl-ent">main</span>:
            <span class="pl-ent">anonymous</span>: <span class="pl-c1">true</span>

            <span class="pl-c"><span class="pl-c">#</span> activate different ways to authenticate</span>

            <span class="pl-c"><span class="pl-c">#</span> http_basic: true</span>
            <span class="pl-c"><span class="pl-c">#</span> https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate</span>

            <span class="pl-ent">form_login</span>: <span class="pl-c1">true</span>
            <span class="pl-c"><span class="pl-c">#</span> https://symfony.com/doc/current/security/form_login_setup.html</span>
            
            <span class="pl-ent">remember_me</span>:
                <span class="pl-ent">secret</span>:               <span class="pl-s"><span class="pl-pds">'</span>%env(APP_SECRET)%<span class="pl-pds">'</span></span> <span class="pl-c"><span class="pl-c">#</span> This used to work</span>
                <span class="pl-ent">token_provider</span>:       <span class="pl-c1">~</span>
                <span class="pl-ent">catch_exceptions</span>:     <span class="pl-c1">true</span>
                <span class="pl-ent">name</span>:                 <span class="pl-s">MAIN_REMEMBERME</span>
                <span class="pl-ent">lifetime</span>:             <span class="pl-c1">604800</span> <span class="pl-c"><span class="pl-c">#</span> one week</span>

    <span class="pl-c"><span class="pl-c">#</span> Easy way to control access for large sections of your site</span>
    <span class="pl-c"><span class="pl-c">#</span> Note: Only the *first* access control that matches will be used</span>
    <span class="pl-ent">access_control</span>:
        <span class="pl-c"><span class="pl-c">#</span> - { path: ^/admin, roles: ROLE_ADMIN }</span>
        <span class="pl-c"><span class="pl-c">#</span> - { path: ^/profile, roles: ROLE_USER }</span></pre></div>
<p dir="auto">And run <code class="notranslate">bin/console cache:clear</code>.</p>
<p dir="auto">I tried debugging the system, but somewhere along execution the Configuration Resolver looses the value. All env variables are present, there are placeholders, and framework.secret works without any issues but the firewall remember_me fails for some unknown reason <g-emoji class="g-emoji" alias="thinking" fallback-src="https://github.githubassets.com/images/icons/emoji/unicode/1f914.png">🤔</g-emoji></p>