title: symfony 5 custom authentication for API REST
body: <p>I'm working on a project with Symfony 5.
  I created the User entity, created the authentication flow on security.yaml and all works well: if user wants to access to protected area, login page was shown and authentication process works! So good!</p>
  <p>Now, I want to build an API REST with FOSRest Bundle.
  I've created a specific controller for expose some routes:</p>
  <pre><code>/**
   * @Rest\Route(&quot;/api&quot;)
   *
   */
  
  class APICustomController extends AbstractController
  {
      ...
      /**
      * @Rest\Get(&quot;/shoes&quot;)
      * @param Request $request
      * @Method({&quot;GET&quot;})
      *
      * @return JsonResponse
      */
      public function getShoes(Request $request){
  
          ....
          return JsonResponse::fromJsonString(array('msg' =&gt; 'OK'));
  
      }
  
  }
  </code></pre>
  <p>Here my security.yaml</p>
  <pre><code>security:
      enable_authenticator_manager: true
      encoders:
          App\Entity\User:
              algorithm: auto
  
      role_hierarchy:
          ROLE_ADMIN: ROLE_USER
          ROLE_VIEWER: ROLE_USER
  
      providers:
          # used to reload user from session &amp; other features (e.g. switch_user)
          app_user_provider:
              entity:
                  class: App\Entity\User
                  property: username
          api_user_provider:
              entity:
                  class: App\Entity\User
                  property: api_token
      firewalls:
          dev:
              pattern: ^/(_(profiler|wdt)|css|images|js)/
              security: false
          main:
              lazy: true
              provider: app_user_provider
              guard:
                  authenticators:
                      - App\Security\DealmapLoginAuthenticator
              logout:
                  path: app_logout
  
          api:
              stateless: true
              lazy: true
              guard:
                  authenticators:
                      - App\Security\TokenAuthenticator
              pattern: ^/api/
              provider: api_user_provider
  
      access_control:
          - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/api, role: IS_AUTHENTICATED_FULLY }
  </code></pre>
  <p>I followed the steps given here: <a href="https://symfony.com/doc/current/security/guard_authentication.html" rel="nofollow noreferrer">https://symfony.com/doc/current/security/guard_authentication.html</a></p>
  <p>The problem is the call below</p>
  <pre><code>curl -X GET \
    http://www.example.com/api/shoes \
    -H 'cache-control: no-cache' \
    -H 'content-type: application/json' \
    -H 'x-auth-token: test'
  </code></pre>
  <p>it is protected by the <strong>main</strong> firewall (so it returns me the login page), and not by <strong>api</strong> as expected. I expect to receive an error message in json format.</p>
  <p>What's wrong??</p>
  <p>Thanks in advance</p>