title: Symfony http basic auth for dev environment without user authentication
body: <p>I have a usual Symfony application including firewalls, user providers, and login via form (FOSUserBundle), custom token authentication (for an app) and even an http basic auth for one part of the application. Of course only one of them is used at a time. Specific areas are secured by different firewalls that connect to those providers.</p>
  
  <p>Extract of the <code>security.yml</code></p>
  
  <pre><code>security:
  
      encoders:
          FOS\UserBundle\Model\UserInterface: sha512
  
      providers:
          authentication_provider:
              entity:
                  class: MyAppBundle:User
                  property: apiKey
          fos_userbundle:
              id: fos_user.user_provider.username
  
  ...
  </code></pre>
  
  <p>Usually there is no <code>app_dev.php</code> on the live system as this is a huge security hole. But it also is a great way to do debugging on the live system if you need to. The idea I had was to just secure the dev environment with an additional http basic auth. This way the dev environment would still be secure but you could access it when needed.</p>
  
  <p>But unfortunately I couldn't get it to work, because as soon as you add the http basic auth to the site in general and log in, your user is authenticated for the Symfony application. This is of course the hole point of doing an authentication in the first place but a deal breaker for the idea because the application can't differentiate between a form login user and a basic auth one (I know I could differentiate between the user types but this would be an additional layer of complexity I'm reluctant to add because it has to be checked in the hole application).</p>
  
  <p>My question is whether it's possible to have a Symfony native http basic auth without the authentication part. So that after completing the basic auth the browser is still sending the http basic auth but you're still anonymous and still have to login via a form (for example) to be authenticated and have access to otherwise restricted content.</p>
  
  <p>EDIT: I know that there are ways to configure this outside of Symfony in the server configuration like in Apache, but I'm searching for a Symfony solution (works without hosting changes incl. locally, can be pushed to source control, ...)</p>
  
  <p>EDIT 2: After a deep dive I've seen that all authentication processes have to return some kind of token. So it might not be as simple as just overwriting a provider and return a Anonymus Token.</p>