After struggling with this error for half an hour and not finding a solution on the web, I finally cracked it 🙂 Just allow the ^_wdt route from the firewall. Symfony uses this route to display the web development toolbar and all routes – both internal and user defined – are intercepted by the firewall.
If you’re having the same problem, here’s a quick fix, just add this to your security.yml file:
- path: ^/_wdt
allow_if: 'request.getClientIp() == "127.0.0.1"'