10 Techniques in Symfony waxay ka caawin doonaa sida Pro

Symfony Security waa mid ka mid ah mid ka mid ah mid ka mid ah mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ah mid ka mid ah mid ka mid ah mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah. Sida loo isticmaali karaa Symfony 7.4. Qalabka adeegga ah ee API iyo AuthenticationEntryPointInterface Sida Symfony 6.2+, AuthenticationEntryPointInterface waa mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah macluumaadka API (JWT, Opaque, iwm) oo ka mid ah mid ka mid ah macluumaadka Guard ah. Waayo, waxaa loo isticmaali karaa in ay ku saabsan Haku A Shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha. Scenario: /api Bearer Create the Authenticator: namespace App\Security; use App\Repository\ApiTokenRepository; use Symfony\Component\HttpFoundation\JsonResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Exception\AuthenticationException; use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException; use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator; use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge; use Symfony\Component\Security\Http\Authenticator\Passport\Passport; use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport; use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface; class ApiTokenAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface { public function __construct(private readonly ApiTokenRepository $apiTokenRepository) { } public function supports(Request $request): ?bool { return $request->headers->has('Authorization') && str_starts_with($request->headers->get('Authorization'), 'Bearer '); } public function authenticate(Request $request): Passport { $apiToken = substr($request->headers->get('Authorization'), 7); if (null === $apiToken) { throw new CustomUserMessageAuthenticationException('No API token provided'); } $token = $this->apiTokenRepository->findOneBy(['token' => $apiToken]); if (null === $token || !$token->isValid()) { throw new CustomUserMessageAuthenticationException('Invalid API Token'); } return new SelfValidatingPassport(new UserBadge($token->getOwner()->getUserIdentifier())); } public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response { return null; } public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response { $data = ['message' => strtr($exception->getMessageKey(), $exception->getMessageData())]; return new JsonResponse($data, Response::HTTP_UNAUTHORIZED); } public function start(Request $request, AuthenticationException $authException = null): Response { return new JsonResponse(['message' => 'Authentication Required'], Response::HTTP_UNAUTHORIZED); } } Configure security.yaml: api: pattern: ^/api stateless: true custom_authenticators: - App\Security\ApiTokenAuthenticator entry_point: App\Security\ApiTokenAuthenticator Verification: Ma rabtaa 401 oo ka mid ah header iyo 200 ka mid ah. curl -I -H "Authorization: Bearer YOUR_VALID_TOKEN" http://localhost:8080/api/profile Waqtiga “Magic Link” Waayo, sidoo kale waxaa laga yaabaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa. Waayo, waxaa loo isticmaali karaa login_link authenticator. login_link: check_route: login_check signature_properties: ['id', 'email'] lifetime: 600 Nala soo xiriir: In your controller: namespace App\Controller; use App\Repository\UserRepository; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Notifier\NotifierInterface; use Symfony\Component\Notifier\Recipient\Recipient; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Authentication\AuthenticationUtils; use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface; use Symfony\Component\Security\Http\LoginLink\LoginLinkNotification; class SecurityController extends AbstractController { #[Route('/login/link', name: 'login_link_start', methods: ['GET', 'POST'])] public function requestLink( Request $request, LoginLinkHandlerInterface $loginLinkHandler, NotifierInterface $notifier, UserRepository $userRepository ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $user = $userRepository->findOneBy(['email' => $email]); if ($user) { $loginLinkDetails = $loginLinkHandler->createLoginLink($user); $notification = (new LoginLinkNotification( $loginLinkDetails, 'Welcome back! Click to login.' )); $notifier->send($notification, new Recipient($user->getEmail())); // For demonstration, we'll dump the link to the profiler instead of sending an email. // In a real app, you'd remove this. $this->addFlash('success', 'Login link sent! Check the profiler for the link.'); $this->addFlash('login_link', $loginLinkDetails->getUrl()); } return $this->render('security/link_sent.html.twig'); } return $this->render('security/request_login_link.html.twig'); } #[Route('/login/check', name: 'login_check')] public function check(): void { throw new \LogicException('This controller should not be reached!'); } } Verification: Shuruudaha dhismaha. Check your mailer transport (e.g., messenger or local logs). Click on the link generated. You should be instantly authenticated. Role Hierarchy ee Database Shuruudaha Symfony Standard waxaa loo yaqaan "Statically" Taageerada Enterprise waa in aad u baahan tahay roles dynamic oo loo isticmaali karaa UI Admin. security.yaml Waxaan ku saabsan adeegyada security.role_hierarchy Create the Decorator namespace App\Security; use App\Repository\RoleRepository; use Symfony\Component\DependencyInjection\Attribute\AsDecorator; use Symfony\Component\Security\Core\Role\RoleHierarchy; use Symfony\Component\Security\Core\Role\RoleHierarchyInterface; #[AsDecorator('security.role_hierarchy')] class DatabaseRoleHierarchy implements RoleHierarchyInterface { private RoleHierarchyInterface $mergedHierarchy; public function __construct( // The decorated service is not used, but is required for the decorator pattern RoleHierarchyInterface $inner, array $staticHierarchy, private readonly RoleRepository $roleRepository ) { $dbHierarchy = $this->roleRepository->findAllHierarchy(); // array_merge_recursive can have unexpected results with numeric keys, but it's fine for role strings. $merged = array_merge_recursive($staticHierarchy, $dbHierarchy); $this->mergedHierarchy = new RoleHierarchy($merged); } public function getReachableRoleNames(array $roles): array { return $this->mergedHierarchy->getReachableRoleNames($roles); } } Verification: Shuruudaha dhismaha Waayo, waxaa loo isticmaali karaa in la isticmaali karaa in la isticmaali karaa. Haku Dhismaha dhismaha iyo dhismaha dhismaha Ma rabtaa in la soo xiriir oo la soo xiriir in la soo xiriir. ROLE_SUPER_MANAGER ROLE_SUPER_MANAGER ROLE_ADMIN $user->getRoles() Qalabka ugu fiican ee shuruudaha ee shuruudaha iyo shuruudaha ee shuruudaha ee shuruudaha. Waayo, waxaa loo isticmaali karaa in ay ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah. Qalabka iyo codsiga ah ee codsiga ah. #[IsGranted] Markaad ka mid ah wax soo saarka, waxaa laga yaabaa in ay ka mid ah wax soo saarka, oo ka mid ah wax soo saarka. The Voter: namespace App\Security\Voter; use App\Entity\Post; use App\Entity\User; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Authorization\Voter\Voter; class PostVoter extends Voter { public const string EDIT = 'POST_EDIT'; protected function supports(string $attribute, mixed $subject): bool { return $attribute === self::EDIT && $subject instanceof Post; } protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof User) { return false; } /** @var Post $post */ $post = $subject; // Rule 1: Author can always edit if ($post->getAuthor() === $user) { return true; } // Rule 2: Editors can only edit if Published if (in_array('ROLE_EDITOR', $user->getRoles()) && $post->isPublished()) { return true; } return false; } } The Controller: namespace App\Controller; use App\Entity\Post; use App\Security\Voter\PostVoter; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Attribute\IsGranted; class PostController extends AbstractController { #[Route('/post/{id}/edit', name: 'post_edit')] #[IsGranted(PostVoter::EDIT, subject: 'post')] public function edit(Post $post): Response { return $this->render('post/edit.html.twig', [ 'post' => $post, ]); } } Verification: Waayo, aad u baahan tahay in ay u soo xiriir oo aad u baahan tahay in ay u baahan tahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay in ay u baahan yahay. . 403 Access Denied Qalabka Qalabka Login Shuruudaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha Configure Rate Limiter: # config/packages/security.yaml security: firewalls: main: login_throttling: max_attempts: 3 Verification: Waayo, waxaa loo yaabaa in la soo bandhigay in la soo bandhigay 4 maalmood oo la soo bandhigay. warshad, si ay u baahan tahay in ay ka mid ah wax soo saarka database. 429 Too Many Requests Auto-Login (Login Auto-Login) oo ka soo xiriir Ka dib markii loo isticmaali karaa, si ay u isticmaali karaa si ay u isticmaali karaa si ay u isticmaali karaa si ay u isticmaali karaa si ay u isticmaali karaa Security helper. namespace App\Controller; use App\Entity\User; use Doctrine\ORM\EntityManagerInterface; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface; use Symfony\Component\Routing\Attribute\Route; class RegistrationController extends AbstractController { #[Route('/register', name: 'app_register', methods: ['GET', 'POST'])] public function register( Request $request, UserPasswordHasherInterface $passwordHasher, EntityManagerInterface $entityManager, Security $security ): Response { if ($request->isMethod('POST')) { $email = $request->request->get('email'); $password = $request->request->get('password'); $user = new User(); $user->setEmail($email); $user->setPassword($passwordHasher->hashPassword($user, $password)); $entityManager->persist($user); $entityManager->flush(); return $security->login($user,'security.authenticator.form_login.main'); } return $this->render('registration/register.html.twig'); } } Verification: Waayo, sidoo kale waxaa laga yaabaa in ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ah mid ka mid ah. Shuruudaha isticmaalka (User Checkers) Sida loo isticmaali karaa in la isticmaali karaa, waxaa loo isticmaali karaa in la isticmaali karaa in la isticmaali karaa in la isticmaali karaa. Haku waa in la soo xiriir oo ka mid ah wax soo saarka ah. UserChecker namespace App\Security; use App\Entity\User; use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException; use Symfony\Component\Security\Core\User\UserCheckerInterface; use Symfony\Component\Security\Core\User\UserInterface; class UserEnabledChecker implements UserCheckerInterface { public function checkPreAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isDeleted()) { throw new CustomUserMessageAccountStatusException('Your account has been deleted.'); } } public function checkPostAuth(UserInterface $user): void { if (!$user instanceof User) { return; } if ($user->isSuspended()) { throw new CustomUserMessageAccountStatusException('Your account is suspended.'); } } } Configuration: Symfony ka soo xiriir Class Implementing Sida loo yaabaa, waxaa laga yaabaa in la soo bandhigay firewall. UserCheckerInterface security: firewalls: main: lazy: true provider: app_user_provider user_checker: App\Security\UserEnabledChecker Verification: Waayo, waxaa loo isticmaali karaa in aad u isticmaali karaa. Haku Waayo, waxaa loo isticmaali karaa in ay ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ka mid ah mid ah mid ka mid ah. is_suspended true Shuruudaha (Switch User) Waayo, waxaa loo yaqaan "Admin" oo ka mid ah "Admin" oo ka mid ah "Admin" oo ka mid ah "Admin". Configuration: security: firewalls: main: switch_user: true role_hierarchy: ROLE_ADMIN: [ROLE_ALLOWED_TO_SWITCH] Restrict Target Users (Optional but Recommended): Ma rabtaa in aad u baahan tahay in aad u isticmaali karaa Super Admin. . Event Listener namespace App\EventListener; use Symfony\Component\EventDispatcher\Attribute\AsEventListener; use Symfony\Component\Security\Core\Exception\AccessDeniedException; use Symfony\Component\Security\Http\Event\SwitchUserEvent; #[AsEventListener(event: SwitchUserEvent::class, method: 'onSwitchUser')] class SwitchUserListener { public function onSwitchUser(SwitchUserEvent $event): void { $targetUser = $event->getTargetUser(); if ($targetUser !== null && in_array('ROLE_SUPER_ADMIN', $targetUser->getRoles())) { throw new AccessDeniedException('Cannot impersonate Super Admins.'); } } } Verification: Ku saabsan admin, guuleysan? Waayo, waxaa laga yaabaa in ay ku yaalaa “Impersonating”. Visit ?_switch_user=_exit to return. _switch_user=someuser@example.com _switch_user=someuser@example.com waxaa laga yaabaa Qalabka Qalabka Qalabka Qalabka Markaas, ROLE_ADMIN waa mid ka mid ah access_control. Waxaad u baahan tahay logic sida "Admins from IP 10.0.0.1" ama "Users with a specific header". security: access_control: - { path: ^/api, roles: ROLE_USER } - { path: ^/admin/sensitive, allow_if: "is_granted('ROLE_ADMIN') and request.getClientIp() in ['127.0.0.1', '::1']" } Verification: Qalabka Access Sida loo isticmaali karaa IP-ka ugu horeysay ee loo isticmaali karaa IP-ka ugu horeysay ee loo isticmaali karaa . /admin/sensitive ROLE_ADMIN Qalabka dhismaha iyo dhismaha iyo dhismaha Sawirada waxaa laga yaabaa in la yaab leh oo ka mid ah wax soo saarka ah oo ka mid ah wax soo saarka. namespace App\EventSubscriber; use Psr\Log\LoggerInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\Security\Http\Event\InteractiveLoginEvent; use Symfony\Component\Security\Http\Event\LoginFailureEvent; use Symfony\Component\Security\Http\SecurityEvents; readonly class SecurityAuditSubscriber implements EventSubscriberInterface { public function __construct(private LoggerInterface $securityLogger) {} public static function getSubscribedEvents(): array { return [ SecurityEvents::INTERACTIVE_LOGIN => 'onLoginSuccess', LoginFailureEvent::class => 'onLoginFailure', ]; } public function onLoginSuccess(InteractiveLoginEvent $event): void { $user = $event->getAuthenticationToken()->getUser(); $this->securityLogger->info('User Login Success', [ 'username' => $user->getUserIdentifier(), 'ip' => $event->getRequest()->getClientIp(), ]); } public function onLoginFailure(LoginFailureEvent $event): void { $this->securityLogger->warning('User Login Failure', [ 'ip' => $event->getRequest()->getClientIp(), 'error' => $event->getException()->getMessage(), 'passport' => $event->getPassport()?->getUser()->getUserIdentifier(), ]); } } Verification: Tail your log file (tail -f var/log/dev.log) iyo soo saarka login. Waxaad ka mid ah u aragto log JSON dhismaha for authentication event. Qalabka Dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha dhismaha In Symfony 7.4, qorshadaha waxay ku yaalaa in ay ku yaalaa in ay ku yaalaa qiyaastii karaa URL-ka. Waxaa ku yaalaa in ay ku habboonayaan adeegga macaamiisha ah oo dhan - xawaaraha Magic Links oo ku yaalaa qiyaastii ah, Impersonation oo ku yaalaa dhismaha macaamiisha, ama Rate Limiters oo ku habboonay in ay ku salaysan in ay ku yaalaa in ay ku salaysan. Sida loo yaabaa in ka mid ah shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu horeysay ee shuruudaha ugu hore Sida loo helo macluumaad ka mid ah macluumaadka, sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale sidoo kale. Waxaad ka mid ah u baahan tahay in ay ka mid ah wax soo saarka ah ee loo yaqaan "GitHub": [ ] Source Code: https://github.com/mattleads/SecurityPatterns https://github.com/mattleads/SecurityPatterns Let’s Connect! Haddii aad u baahan tahay in aad u isticmaali karaa, ama aad u baahan tahay in aad u isticmaali karaa, waxaan sidoo kale u baahan tahay in aad isticmaali karaa in aad isticmaali karaa. Haku: [https://www.linkedin.com/in/matthew-mochalkin/] X (Twitter): [https://x.com/MattLeads] Haku: [https://t.me/MattLeads] GitHub: [https://github.com/mattleads] https://www.linkedin.com/in/matthew-mochalkin/ https://x.com/MattLeads https://t.me/MattLeads https://github.com/mattleads