I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my
services.yml and referencing it in the
.yml of the resource, it is called for each route, not just my resources, as logging reveals. Yes, I can inject a
RouteMatchInterface into my auth provider and use the
applies() function to check whether the provider should be consulted on a specific route but why is this required?
Can't I limit my provider to only the resource I plan to use it with? Using
applies() not only means extra overhead on each call, it makes it awkward to maintain, needing to modify usage in both places, the config files and the auth provider source code.