For Nginx in PROD env, this makes more difficult to know that app is running Symfony.
app.php is widely known as our default front controller.
It is a small effort by security through obscurity.
For Apache, this 301 must be replaced by 404:
https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New feature?  | no
| Applies to    | 2.0+
| Tests pass?   | yes
| Fixed tickets |
* Replaced IF statement by "internal" directive.
* Splitted config for PROD and DEV environments.
Updated docblock for config in DEV environment.
feature #4295 [Security] Hidden front controller for Nginx (phansys)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #4295).

Discussion
----------

[Security] Hidden front controller for Nginx

For Nginx in PROD env, this makes more difficult to know that app is running Symfony.

app.php is widely known as our default front controller.
It is a small effort by security through obscurity.
For Apache, [this 301 must be replaced by 404](https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37).

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New feature?  | no
| Applies to    | 2.0+
| Tests pass?   | yes
| Fixed tickets |

Commits
-------

fed56c2 Updated docblock for config in DEV environment.
d1f1b33 * Replaced IF statement by "internal" directive. * Splitted config for PROD and DEV environments.
ebf4ea8 For Nginx in PROD env, this makes more difficult to know that app is running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, this 301 must be replaced by 404: https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37