10 Techniques in Symfony That Will Help You Secure Like a Pro

The Symfony Security component is often underestimated, treated merely as a “login gate.” In reality, it is a sophisticated authorization framework capable of handling complex state machines, hierarchical permissions, and stateless authentication flow. This guide explores 10 advanced patterns using Symfony 7.4. Stateless API Authentication with AuthenticationEntryPointInterface Modern apps often require a stateless API alongside a stateful frontend. Since Symfony 6.2+, the AuthenticationEntryPointInterface is the preferred way to handle API tokens (JWT, Opaque, etc.) without the overhead of the old Guard authenticators. Scenario: You need to secure routes under /api using a Bearer token, verifying it against a database or external service, completely bypassing sessions. Scenario: /api Bearer Create the Authenticator: Create the Authenticator: namespace App\Security; use App\Repository\ApiTokenRepository; use Symfony\Component\HttpFoundation\JsonResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Exception\AuthenticationException; use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException; use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator; use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge; use Symfony\Component\Security\Http\Authenticator\Passport\Passport; use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport; use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface; class ApiTokenAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface { public function __construct(private readonly ApiTokenRepository $apiTokenRepository) { } public function supports(Request $request): ?bool { return $request->headers->has('Authorization') && str_starts_with($request->headers->get('Authorization'), 'Bearer '); } public function authenticate(Request $request): Passport { $apiToken = substr($request->headers->get('Authorization'), 7); if (null === $apiToken) { throw new CustomUserMessageAuthenticationException('No API token provided'); } $token = $this->apiTokenRepository->findOneBy(['token' => $apiToken]); if (null === $token || !$token->isValid()) { throw new CustomUserMessageAuthenticationException('Invalid API Token'); } return new SelfValidatingPassport(new UserBadge($token->getOwner()->getUserIdentifier())); } public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response { return null; } public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response { $data = ['message' => strtr($exception->getMessageKey(), $exception->getMessageData())]; return new JsonResponse($data, Response::HTTP_UNAUTHORIZED); } public function start(Request $request, AuthenticationException $authException = null): Response { return new JsonResponse(['message' => 'Authentication Required'], Response::HTTP_UNAUTHORIZED); } } namespace App\Security; use App\Repository\ApiTokenRepository; use Symfony\Component\HttpFoundation\JsonResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Exception\AuthenticationException; use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException; use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator; use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge; use Symfony\Component\Security\Http\Authenticator\Passport\Passport; use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport; use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface; class ApiTokenAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface { public function __construct(private readonly ApiTokenRepository $apiTokenRepository) { } public function supports(Request $request): ?bool { return $request->headers->has('Authorization') && str_starts_with($request->headers->get('Authorization'), 'Bearer '); } public function authenticate(Request $request): Passport { $apiToken = substr($request->headers->get('Authorization'), 7); if (null === $apiToken) { throw new CustomUserMessageAuthenticationException('No API token provided'); } $token = $this->apiTokenRepository->findOneBy(['token' => $apiToken]); if (null === $token || !$token->isValid()) { throw new CustomUserMessageAuthenticationException('Invalid API Token'); } return new SelfValidatingPassport(new UserBadge($token->getOwner()->getUserIdentifier())); } public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response { return null; } public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response { $data = ['message' => strtr($exception->getMessageKey(), $exception->getMessageData())]; return new JsonResponse($data, Response::HTTP_UNAUTHORIZED); } public function start(Request $request, AuthenticationException $authException = null): Response { return new JsonResponse(['message' => 'Authentication Required'], Response::HTTP_UNAUTHORIZED); } } Configure security.yaml: Configure security.yaml: api: pattern: ^/api stateless: true custom_authenticators: - App\Security\ApiTokenAuthenticator entry_point: App\Security\ApiTokenAuthenticator api: pattern: ^/api stateless: true custom_authenticators: - App\Security\ApiTokenAuthenticator entry_point: App\Security\ApiTokenAuthenticator Verification: Verification: Execute a cURL request. You should receive a 401 without the header and 200 with it. curl -I -H "Authorization: Bearer YOUR_VALID_TOKEN" http://localhost:8080/api/profile curl -I -H "Authorization: Bearer YOUR_VALID_TOKEN" http://localhost:8080/api/profile Passwordless “Magic Link” Authentication For ease of use, you may want to allow users to log in by clicking a link sent to their email, bypassing passwords entirely. Configure the Authenticator: Enable the native login_link authenticator. login_link: check_route: login_check signature_properties: ['id', 'email'] lifetime: 600 login_link: check_route: login_check signature_properties: ['id', 'email'] lifetime: 600 Generate and Send the Link: In your controller: namespace App\Controller; use App\Repository\UserRepository; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Notifier\NotifierInterface; use Symfony\Component\Notifier\Recipient\Recipient; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Authentication\AuthenticationUtils; use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface; use Symfony\Component\Security\Http\LoginLink\LoginLinkNotification; class SecurityController extends AbstractController { #[Route('/login/link', name: 'login_link_start', methods: ['GET', 'POST'])] public function requestLink( Request $request, LoginLinkHandlerInterface $loginLinkHandler, NotifierInterface $notifier, UserRepository $userRepository ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $user = $userRepository->findOneBy(['email' => $email]); if ($user) { $loginLinkDetails = $loginLinkHandler->createLoginLink($user); $notification = (new LoginLinkNotification( $loginLinkDetails, 'Welcome back! Click to login.' )); $notifier->send($notification, new Recipient($user->getEmail())); // For demonstration, we'll dump the link to the profiler instead of sending an email. // In a real app, you'd remove this. $this->addFlash('success', 'Login link sent! Check the profiler for the link.'); $this->addFlash('login_link', $loginLinkDetails->getUrl()); } return $this->render('security/link_sent.html.twig'); } return $this->render('security/request_login_link.html.twig'); } #[Route('/login/check', name: 'login_check')] public function check(): void { throw new \LogicException('This controller should not be reached!'); } } namespace App\Controller; use App\Repository\UserRepository; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Notifier\NotifierInterface; use Symfony\Component\Notifier\Recipient\Recipient; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Authentication\AuthenticationUtils; use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface; use Symfony\Component\Security\Http\LoginLink\LoginLinkNotification; class SecurityController extends AbstractController { #[Route('/login/link', name: 'login_link_start', methods: ['GET', 'POST'])] public function requestLink( Request $request, LoginLinkHandlerInterface $loginLinkHandler, NotifierInterface $notifier, UserRepository $userRepository ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $user = $userRepository->findOneBy(['email' => $email]); if ($user) { $loginLinkDetails = $loginLinkHandler->createLoginLink($user); $notification = (new LoginLinkNotification( $loginLinkDetails, 'Welcome back! Click to login.' )); $notifier->send($notification, new Recipient($user->getEmail())); // For demonstration, we'll dump the link to the profiler instead of sending an email. // In a real app, you'd remove this. $this->addFlash('success', 'Login link sent! Check the profiler for the link.'); $this->addFlash('login_link', $loginLinkDetails->getUrl()); } return $this->render('security/link_sent.html.twig'); } return $this->render('security/request_login_link.html.twig'); } #[Route('/login/check', name: 'login_check')] public function check(): void { throw new \LogicException('This controller should not be reached!'); } } Verification: Verification: Submit the form. Check your mailer transport (e.g., messenger or local logs). Click the link generated. You should be instantly authenticated. Dynamic Role Hierarchy from Database Standard Symfony roles are defined statically in security.yaml. Enterprise apps often require dynamic roles configurable via an Admin UI. security.yaml We decorate the security.role_hierarchy service. security.role_hierarchy Create the Decorator Create the Decorator namespace App\Security; use App\Repository\RoleRepository; use Symfony\Component\DependencyInjection\Attribute\AsDecorator; use Symfony\Component\Security\Core\Role\RoleHierarchy; use Symfony\Component\Security\Core\Role\RoleHierarchyInterface; #[AsDecorator('security.role_hierarchy')] class DatabaseRoleHierarchy implements RoleHierarchyInterface { private RoleHierarchyInterface $mergedHierarchy; public function __construct( // The decorated service is not used, but is required for the decorator pattern RoleHierarchyInterface $inner, array $staticHierarchy, private readonly RoleRepository $roleRepository ) { $dbHierarchy = $this->roleRepository->findAllHierarchy(); // array_merge_recursive can have unexpected results with numeric keys, but it's fine for role strings. $merged = array_merge_recursive($staticHierarchy, $dbHierarchy); $this->mergedHierarchy = new RoleHierarchy($merged); } public function getReachableRoleNames(array $roles): array { return $this->mergedHierarchy->getReachableRoleNames($roles); } } namespace App\Security; use App\Repository\RoleRepository; use Symfony\Component\DependencyInjection\Attribute\AsDecorator; use Symfony\Component\Security\Core\Role\RoleHierarchy; use Symfony\Component\Security\Core\Role\RoleHierarchyInterface; #[AsDecorator('security.role_hierarchy')] class DatabaseRoleHierarchy implements RoleHierarchyInterface { private RoleHierarchyInterface $mergedHierarchy; public function __construct( // The decorated service is not used, but is required for the decorator pattern RoleHierarchyInterface $inner, array $staticHierarchy, private readonly RoleRepository $roleRepository ) { $dbHierarchy = $this->roleRepository->findAllHierarchy(); // array_merge_recursive can have unexpected results with numeric keys, but it's fine for role strings. $merged = array_merge_recursive($staticHierarchy, $dbHierarchy); $this->mergedHierarchy = new RoleHierarchy($merged); } public function getReachableRoleNames(array $roles): array { return $this->mergedHierarchy->getReachableRoleNames($roles); } } Verification: Verification: Assign a custom role ROLE_SUPER_MANAGER to a user in the DB. Ensure ROLE_SUPER_MANAGER inherits ROLE_ADMIN in your database table. Log in and dump $user->getRoles(). You should see the inherited roles appear automatically. ROLE_SUPER_MANAGER ROLE_SUPER_MANAGER ROLE_ADMIN $user->getRoles() Complex Business Logic with Voters and Attributes Don’t put authorization logic in controllers. Use Voters. In Symfony 7.4, we can combine #[IsGranted] with specific subjects and attributes for clean code. #[IsGranted] A user can edit a Post only if they are the author OR if they are an Editor and the post is “Published” (but not Draft). The Voter: The Voter: namespace App\Security\Voter; use App\Entity\Post; use App\Entity\User; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Authorization\Voter\Voter; class PostVoter extends Voter { public const string EDIT = 'POST_EDIT'; protected function supports(string $attribute, mixed $subject): bool { return $attribute === self::EDIT && $subject instanceof Post; } protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof User) { return false; } /** @var Post $post */ $post = $subject; // Rule 1: Author can always edit if ($post->getAuthor() === $user) { return true; } // Rule 2: Editors can only edit if Published if (in_array('ROLE_EDITOR', $user->getRoles()) && $post->isPublished()) { return true; } return false; } } namespace App\Security\Voter; use App\Entity\Post; use App\Entity\User; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Authorization\Voter\Voter; class PostVoter extends Voter { public const string EDIT = 'POST_EDIT'; protected function supports(string $attribute, mixed $subject): bool { return $attribute === self::EDIT && $subject instanceof Post; } protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof User) { return false; } /** @var Post $post */ $post = $subject; // Rule 1: Author can always edit if ($post->getAuthor() === $user) { return true; } // Rule 2: Editors can only edit if Published if (in_array('ROLE_EDITOR', $user->getRoles()) && $post->isPublished()) { return true; } return false; } } The Controller: The Controller: namespace App\Controller; use App\Entity\Post; use App\Security\Voter\PostVoter; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Attribute\IsGranted; class PostController extends AbstractController { #[Route('/post/{id}/edit', name: 'post_edit')] #[IsGranted(PostVoter::EDIT, subject: 'post')] public function edit(Post $post): Response { return $this->render('post/edit.html.twig', [ 'post' => $post, ]); } } namespace App\Controller; use App\Entity\Post; use App\Security\Voter\PostVoter; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Attribute\IsGranted; class PostController extends AbstractController { #[Route('/post/{id}/edit', name: 'post_edit')] #[IsGranted(PostVoter::EDIT, subject: 'post')] public function edit(Post $post): Response { return $this->render('post/edit.html.twig', [ 'post' => $post, ]); } } Verification: Verification: Try to access the edit route as a non-author on a Draft post. You will receive a 403 Access Denied. 403 Access Denied Rate Limiting Login Attempts Brute force protection is critical. Symfony integrates RateLimiter directly into the firewall. Configure Rate Limiter: Configure Rate Limiter: # config/packages/security.yaml security: firewalls: main: login_throttling: max_attempts: 3 # config/packages/security.yaml security: firewalls: main: login_throttling: max_attempts: 3 Verification: Verification: Attempt to log in with a wrong password 4 times in rapid succession. The 4th attempt will throw a 429 Too Many Requests error, preventing the check from even hitting the database. 429 Too Many Requests Programmatic Login (Auto-login after Registration) After a user registers, forcing them to type their password again is bad UX. You can log them in programmatically using the Security helper. namespace App\Controller; use App\Entity\User; use Doctrine\ORM\EntityManagerInterface; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface; use Symfony\Component\Routing\Attribute\Route; class RegistrationController extends AbstractController { #[Route('/register', name: 'app_register', methods: ['GET', 'POST'])] public function register( Request $request, UserPasswordHasherInterface $passwordHasher, EntityManagerInterface $entityManager, Security $security ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $password = $request->request->get('password'); $user = new User(); $user->setEmail($email); $user->setPassword($passwordHasher->hashPassword($user, $password)); $entityManager->persist($user); $entityManager->flush(); return $security->login($user,'security.authenticator.form_login.main'); } return $this->render('registration/register.html.twig'); } } namespace App\Controller; use App\Entity\User; use Doctrine\ORM\EntityManagerInterface; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface; use Symfony\Component\Routing\Attribute\Route; class RegistrationController extends AbstractController { #[Route('/register', name: 'app_register', methods: ['GET', 'POST'])] public function register( Request $request, UserPasswordHasherInterface $passwordHasher, EntityManagerInterface $entityManager, Security $security ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $password = $request->request->get('password'); $user = new User(); $user->setEmail($email); $user->setPassword($passwordHasher->hashPassword($user, $password)); $entityManager->persist($user); $entityManager->flush(); return $security->login($user,'security.authenticator.form_login.main'); } return $this->render('registration/register.html.twig'); } } Verification: Verification: Register a new user via your form. Observe that you are immediately redirected to the dashboard and the profiler shows you as authenticated. Blocking Suspended Users (User Checkers) If you ban a user in the database, they might still be logged in if their session is active. UserChecker runs on every request for active sessions. UserChecker namespace App\Security; use App\Entity\User; use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException; use Symfony\Component\Security\Core\User\UserCheckerInterface; use Symfony\Component\Security\Core\User\UserInterface; class UserEnabledChecker implements UserCheckerInterface { public function checkPreAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isDeleted()) { throw new CustomUserMessageAccountStatusException('Your account has been deleted.'); } } public function checkPostAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isSuspended()) { throw new CustomUserMessageAccountStatusException('Your account is suspended.'); } } } namespace App\Security; use App\Entity\User; use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException; use Symfony\Component\Security\Core\User\UserCheckerInterface; use Symfony\Component\Security\Core\User\UserInterface; class UserEnabledChecker implements UserCheckerInterface { public function checkPreAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isDeleted()) { throw new CustomUserMessageAccountStatusException('Your account has been deleted.'); } } public function checkPostAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isSuspended()) { throw new CustomUserMessageAccountStatusException('Your account is suspended.'); } } } Configuration: Configuration: Symfony automatically tags classes implementing UserCheckerInterface. However, you must explicitly link it in the firewall. UserCheckerInterface security: firewalls: main: lazy: true provider: app_user_provider user_checker: App\Security\UserEnabledChecker security: firewalls: main: lazy: true provider: app_user_provider user_checker: App\Security\UserEnabledChecker Verification: Verification: Log in as a valid user. Manually change their is_suspended flag to true in the database. Refresh the page. You should be immediately logged out and redirected to the login page with the error message. is_suspended true Impersonation (Switch User) Allow admins to “become” other users to debug issues. Configuration: Configuration: security: firewalls: main: switch_user: true role_hierarchy: ROLE_ADMIN: [ROLE_ALLOWED_TO_SWITCH] security: firewalls: main: switch_user: true role_hierarchy: ROLE_ADMIN: [ROLE_ALLOWED_TO_SWITCH] Restrict Target Users (Optional but Recommended): Restrict Target Users (Optional but Recommended): You usually don’t want an Admin to impersonate a Super Admin. Use an Event Listener. Event Listener namespace App\EventListener; use Symfony\Component\EventDispatcher\Attribute\AsEventListener; use Symfony\Component\Security\Core\Exception\AccessDeniedException; use Symfony\Component\Security\Http\Event\SwitchUserEvent; #[AsEventListener(event: SwitchUserEvent::class, method: 'onSwitchUser')] class SwitchUserListener { public function onSwitchUser(SwitchUserEvent $event): void { $targetUser = $event->getTargetUser(); if ($targetUser !== null && in_array('ROLE_SUPER_ADMIN', $targetUser->getRoles())) { throw new AccessDeniedException('Cannot impersonate Super Admins.'); } } } namespace App\EventListener; use Symfony\Component\EventDispatcher\Attribute\AsEventListener; use Symfony\Component\Security\Core\Exception\AccessDeniedException; use Symfony\Component\Security\Http\Event\SwitchUserEvent; #[AsEventListener(event: SwitchUserEvent::class, method: 'onSwitchUser')] class SwitchUserListener { public function onSwitchUser(SwitchUserEvent $event): void { $targetUser = $event->getTargetUser(); if ($targetUser !== null && in_array('ROLE_SUPER_ADMIN', $targetUser->getRoles())) { throw new AccessDeniedException('Cannot impersonate Super Admins.'); } } } Verification: Verification: As an admin, visit ?_switch_user=someuser@example.com. The toolbar should show “Impersonating”. Visit ?_switch_user=_exit to return. _switch_user=someuser@example.com _switch_user=someuser@example.com Complex Access Control with Expressions Sometimes, ROLE_ADMIN isn’t enough in access_control. You need logic like “Admins from IP 10.0.0.1” or “Users with a specific header”. security: access_control: - { path: ^/api, roles: ROLE_USER } - { path: ^/admin/sensitive, allow_if: "is_granted('ROLE_ADMIN') and request.getClientIp() in ['127.0.0.1', '::1']" } security: access_control: - { path: ^/api, roles: ROLE_USER } - { path: ^/admin/sensitive, allow_if: "is_granted('ROLE_ADMIN') and request.getClientIp() in ['127.0.0.1', '::1']" } Verification: Verification: Try accessing /admin/sensitive from a different IP (or mock the IP in a test). It should deny access even if you have ROLE_ADMIN. /admin/sensitive ROLE_ADMIN Security Audit Logging via Events Security is incomplete without observability. You should log successful logins, failures and access denied events. namespace App\EventSubscriber; use Psr\Log\LoggerInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\Security\Http\Event\InteractiveLoginEvent; use Symfony\Component\Security\Http\Event\LoginFailureEvent; use Symfony\Component\Security\Http\SecurityEvents; readonly class SecurityAuditSubscriber implements EventSubscriberInterface { public function __construct(private LoggerInterface $securityLogger) {} public static function getSubscribedEvents(): array { return [ SecurityEvents::INTERACTIVE_LOGIN => 'onLoginSuccess', LoginFailureEvent::class => 'onLoginFailure', ]; } public function onLoginSuccess(InteractiveLoginEvent $event): void { $user = $event->getAuthenticationToken()->getUser(); $this->securityLogger->info('User Login Success', [ 'username' => $user->getUserIdentifier(), 'ip' => $event->getRequest()->getClientIp(), ]); } public function onLoginFailure(LoginFailureEvent $event): void { $this->securityLogger->warning('User Login Failure', [ 'ip' => $event->getRequest()->getClientIp(), 'error' => $event->getException()->getMessage(), 'passport' => $event->getPassport()?->getUser()->getUserIdentifier(), ]); } } namespace App\EventSubscriber; use Psr\Log\LoggerInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\Security\Http\Event\InteractiveLoginEvent; use Symfony\Component\Security\Http\Event\LoginFailureEvent; use Symfony\Component\Security\Http\SecurityEvents; readonly class SecurityAuditSubscriber implements EventSubscriberInterface { public function __construct(private LoggerInterface $securityLogger) {} public static function getSubscribedEvents(): array { return [ SecurityEvents::INTERACTIVE_LOGIN => 'onLoginSuccess', LoginFailureEvent::class => 'onLoginFailure', ]; } public function onLoginSuccess(InteractiveLoginEvent $event): void { $user = $event->getAuthenticationToken()->getUser(); $this->securityLogger->info('User Login Success', [ 'username' => $user->getUserIdentifier(), 'ip' => $event->getRequest()->getClientIp(), ]); } public function onLoginFailure(LoginFailureEvent $event): void { $this->securityLogger->warning('User Login Failure', [ 'ip' => $event->getRequest()->getClientIp(), 'error' => $event->getException()->getMessage(), 'passport' => $event->getPassport()?->getUser()->getUserIdentifier(), ]); } } Verification: Verification: Tail your log file (tail -f var/log/dev.log) and perform a login. You will see the structured JSON log entry for the authentication event. Conclusion The Symfony Security component has long held a reputation for being one of the most complex parts of the framework. However, as we’ve explored in these ten patterns, that complexity translates directly into granular control and enterprise-grade flexibility. In Symfony 7.4, security is no longer just about preventing unauthorized access to a URL. It is about crafting seamless user experiences — whether through Magic Links that reduce friction, Impersonation that empowers support teams, or Rate Limiters that quietly protect your infrastructure. By moving beyond standard form_login and embracing tools like the Voters, custom UserCheckers, you shift security logic out of your controllers and into dedicated, testable classes. This follows the core philosophy of modern PHP development: decoupling. Your controllers remain thin, your business logic remains pure, and your security policies become reusable assets rather than hard-coded conditional checks. As you implement these patterns, remember that security is not a feature you add at the end; it is an architectural standard you bake in from the start. Source Code: You can find the full implementation and follow the project’s progress on GitHub: [https://github.com/mattleads/SecurityPatterns] Source Code: https://github.com/mattleads/SecurityPatterns https://github.com/mattleads/SecurityPatterns Let’s Connect! Let’s Connect! If you found this helpful or have questions about the implementation, I’d love to hear from you. Let’s stay in touch and keep the conversation going across these platforms: LinkedIn: [https://www.linkedin.com/in/matthew-mochalkin/] X (Twitter): [https://x.com/MattLeads] Telegram: [https://t.me/MattLeads] GitHub: [https://github.com/mattleads] LinkedIn: [https://www.linkedin.com/in/matthew-mochalkin/] https://www.linkedin.com/in/matthew-mochalkin/ https://www.linkedin.com/in/matthew-mochalkin/ X (Twitter): [https://x.com/MattLeads] https://x.com/MattLeads https://x.com/MattLeads Telegram: [https://t.me/MattLeads] https://t.me/MattLeads https://t.me/MattLeads GitHub: [https://github.com/mattleads] https://github.com/mattleads https://github.com/mattleads