diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index 560c7a3..6ddcd34 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -32,6 +32,7 @@ security:
                 token_provider:
                     doctrine: true
     access_control:
+        - { path: '^/_uploader', roles: ROLE_USER, requires_channel: https }
         - { path: '^/', roles: PUBLIC_ACCESS, requires_channel: https }
 
 when@test: