Sehemu ya Usalama wa Symfony mara nyingi inachukuliwa chini, inachukuliwa tu kama "mstari wa kuingia." Mwongozo huu unachunguza mifano ya juu ya 10 kwa kutumia Symfony 7.4. Utambulisho wa API bila utambulisho na UtambulishoEntryPointInterface Programu za kisasa mara nyingi zinahitaji API isiyo na hali pamoja na frontend ya hali. Tangu Symfony 6.2+, AuthenticationEntryPointInterface ni njia iliyopendekezwa ya kushughulikia tokens API (JWT, Opaque, nk) bila ya juu ya walimu wa zamani wa Guard. Unahitaji kuhifadhi barabara chini ya Kutumia kwa a token, kuthibitisha dhidi ya database au huduma ya nje, kikamilifu kuepuka mikutano. Scenario: /api Bearer Create the Authenticator: namespace App\Security;

use App\Repository\ApiTokenRepository;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;

use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;

class ApiTokenAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface
{
    public function __construct(private readonly ApiTokenRepository $apiTokenRepository)
    {
    }

    public function supports(Request $request): ?bool
    {
        return $request->headers->has('Authorization') && str_starts_with($request->headers->get('Authorization'), 'Bearer ');
    }

    public function authenticate(Request $request): Passport
    {
        $apiToken = substr($request->headers->get('Authorization'), 7);
        if (null === $apiToken) {
            throw new CustomUserMessageAuthenticationException('No API token provided');
        }

        $token = $this->apiTokenRepository->findOneBy(['token' => $apiToken]);
        if (null === $token || !$token->isValid()) {
            throw new CustomUserMessageAuthenticationException('Invalid API Token');
        }

        return new SelfValidatingPassport(new UserBadge($token->getOwner()->getUserIdentifier()));
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        return null;
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
    {
        $data = ['message' => strtr($exception->getMessageKey(), $exception->getMessageData())];

        return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
    }

    public function start(Request $request, AuthenticationException $authException = null): Response
    {
        return new JsonResponse(['message' => 'Authentication Required'], Response::HTTP_UNAUTHORIZED);
    }
}
 Configure security.yaml:         api:
            pattern: ^/api
            stateless: true
            custom_authenticators:
                - App\Security\ApiTokenAuthenticator
            entry_point: App\Security\ApiTokenAuthenticator
 Verification: Kuendesha ombi la cURL. Unapaswa kupokea 401 bila kichwa na 200 pamoja naye. curl -I -H "Authorization: Bearer YOUR_VALID_TOKEN" http://localhost:8080/api/profile
 Uhakiki wa “Magic Link” bila Password Kwa urahisi wa matumizi, unaweza kuruhusu watumiaji kuingia kwa kubonyeza kiungo kilichotumwa kwa barua pepe yao, kuepuka nywila kabisa. Kuanzisha Utambulisho: Kuwezesha utambulisho wa native login_link.             login_link:
                check_route: login_check
                signature_properties: ['id', 'email']
                lifetime: 600
 Kuunda na kutuma kiungo: Katika msimamizi wako: namespace App\Controller;

use App\Repository\UserRepository;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Notifier\NotifierInterface;
use Symfony\Component\Notifier\Recipient\Recipient;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface;
use Symfony\Component\Security\Http\LoginLink\LoginLinkNotification;

class SecurityController extends AbstractController
{

    #[Route('/login/link', name: 'login_link_start', methods: ['GET', 'POST'])]
    public function requestLink(
        Request $request,
        LoginLinkHandlerInterface $loginLinkHandler,
        NotifierInterface $notifier,
        UserRepository $userRepository
    ): Response {
        if ($request->isMethod('POST')) {
            $email = $request->request->get('email');
            $user = $userRepository->findOneBy(['email' => $email]);

            if ($user) {
                $loginLinkDetails = $loginLinkHandler->createLoginLink($user);

                $notification = (new LoginLinkNotification(
                    $loginLinkDetails,
                    'Welcome back! Click to login.'
                ));
                $notifier->send($notification, new Recipient($user->getEmail()));

                // For demonstration, we'll dump the link to the profiler instead of sending an email.
                // In a real app, you'd remove this.
                $this->addFlash('success', 'Login link sent! Check the profiler for the link.');
                $this->addFlash('login_link', $loginLinkDetails->getUrl());
            }

            return $this->render('security/link_sent.html.twig');
        }

        return $this->render('security/request_login_link.html.twig');
    }

    #[Route('/login/check', name: 'login_check')]
    public function check(): void
    {
        throw new \LogicException('This controller should not be reached!');
    }
}
 Verification: Kuwasilisha fomu. Angalia usafirishaji wako wa barua pepe (kwa mfano, barua pepe au kumbukumbu za mitaa). Bonyeza kiungo kilichoundwa. Unapaswa kufahamu mara moja. Role Hierarchy kutoka Database Majukumu ya kawaida ya Symfony yanafafanuliwa statically katika Programu za Biashara mara nyingi zinahitaji majukumu ya kimwili ambayo yanaweza kurekebishwa kupitia UI ya Admin. security.yaml Tunaandaa kwa ajili ya Huduma ya security.role_hierarchy Create the Decorator namespace App\Security;

use App\Repository\RoleRepository;
use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
use Symfony\Component\Security\Core\Role\RoleHierarchy;
use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;

#[AsDecorator('security.role_hierarchy')]
class DatabaseRoleHierarchy implements RoleHierarchyInterface
{
    private RoleHierarchyInterface $mergedHierarchy;

    public function __construct(
        // The decorated service is not used, but is required for the decorator pattern
        RoleHierarchyInterface $inner, 
        array $staticHierarchy,
        private readonly RoleRepository $roleRepository
    ) {
        $dbHierarchy = $this->roleRepository->findAllHierarchy();

        // array_merge_recursive can have unexpected results with numeric keys, but it's fine for role strings.
        $merged = array_merge_recursive($staticHierarchy, $dbHierarchy);

        $this->mergedHierarchy = new RoleHierarchy($merged);
    }

    public function getReachableRoleNames(array $roles): array
    {
        return $this->mergedHierarchy->getReachableRoleNames($roles);
    }
}
 Verification: Kuweka jukumu la kawaida kwa mtumiaji katika DB. kuhakikisha Urithi wa katika orodha yako ya database. Log in na dump Unapaswa kuona majukumu ya urithi kuonekana moja kwa moja. ROLE_SUPER_MANAGER ROLE_SUPER_MANAGER ROLE_ADMIN $user->getRoles() Mantiki ya Biashara ya Mchanganyiko na Wabunge na Attributes Usisahau kwamba ili vita kwa utukufu 2 rasilimali haja kucheza. na mandhari maalum na sifa kwa ajili ya msimbo safi. #[IsGranted] Mtumiaji anaweza kuhariri chapisho tu ikiwa wao ni mwandishi au kama wao ni mhariri na chapisho ni "Kichapishwa" (lakini sio Draft). The Voter: namespace App\Security\Voter;

use App\Entity\Post;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class PostVoter extends Voter
{
    public const string EDIT = 'POST_EDIT';

    protected function supports(string $attribute, mixed $subject): bool
    {
        return $attribute === self::EDIT && $subject instanceof Post;
    }

    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
    {
        $user = $token->getUser();
        if (!$user instanceof User) {
            return false;
        }

        /** @var Post $post */
        $post = $subject;

        // Rule 1: Author can always edit
        if ($post->getAuthor() === $user) {
            return true;
        }

        // Rule 2: Editors can only edit if Published
        if (in_array('ROLE_EDITOR', $user->getRoles()) && $post->isPublished()) {
            return true;
        }

        return false;
    }
}
 The Controller: namespace App\Controller;

use App\Entity\Post;
use App\Security\Voter\PostVoter;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;

class PostController extends AbstractController
{
    #[Route('/post/{id}/edit', name: 'post_edit')]
    #[IsGranted(PostVoter::EDIT, subject: 'post')]
    public function edit(Post $post): Response
    {
        return $this->render('post/edit.html.twig', [
            'post' => $post,
        ]);
    }
}
 Verification: Jaribu kufikia njia ya kuhariri kama mwandishi wasiokuwa mwandishi kwenye chapisho la Mpango. . 403 Access Denied Kiwango cha kupunguza majaribio ya login Ulinzi wa nguvu ni muhimu. Symfony inachanganya RateLimiter moja kwa moja kwenye firewall. Configure Rate Limiter: # config/packages/security.yaml
security:
    firewalls:
        main:
            login_throttling:
                max_attempts: 3
 Verification: Kujaribu kuingia na password mbaya mara 4 katika mfululizo wa haraka. jaribio la nne litatoa makosa, kuzuia cheque hata kushuka kwenye database. 429 Too Many Requests Usajili wa Programu (Auto-login baada ya Usajili) Baada ya mtumiaji kujiandikisha, kulazimisha kuingia password yao tena ni UX mbaya. Unaweza kuingia kwa programu kwa kutumia msaidizi wa Usalama. namespace App\Controller;

use App\Entity\User;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
use Symfony\Component\Routing\Attribute\Route;

class RegistrationController extends AbstractController
{
    #[Route('/register', name: 'app_register', methods: ['GET', 'POST'])]
    public function register(
        Request $request,
        UserPasswordHasherInterface $passwordHasher,
        EntityManagerInterface $entityManager,
        Security $security
    ): Response
    {
        if ($request->isMethod('POST')) {
            $email = $request->request->get('email');
            $password = $request->request->get('password');

            $user = new User();
            $user->setEmail($email);
            $user->setPassword($passwordHasher->hashPassword($user, $password));

            $entityManager->persist($user);
            $entityManager->flush();

            return $security->login($user,'security.authenticator.form_login.main');
        }

        return $this->render('registration/register.html.twig');
    }
}
 Verification: Kumbuka kwamba wewe ni mara moja redirected kwa dashboard na profile inaonyesha wewe kama kuthibitishwa. Kuzuia Watumiaji Wamesimamishwa (User Checkers) Ikiwa unakataza mtumiaji katika database, wanaweza bado kuingia ikiwa mkusanyiko wao ni kazi. kuendesha juu ya kila ombi kwa ajili ya mikutano ya kazi. UserChecker namespace App\Security;

use App\Entity\User;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
use Symfony\Component\Security\Core\User\UserCheckerInterface;
use Symfony\Component\Security\Core\User\UserInterface;

class UserEnabledChecker implements UserCheckerInterface
{
    public function checkPreAuth(UserInterface $user): void
    {
        if (!$user instanceof User) {
            return;
        }

        if ($user->isDeleted()) {
            throw new CustomUserMessageAccountStatusException('Your account has been deleted.');
        }
    }

    public function checkPostAuth(UserInterface $user): void
    {
        if (!$user instanceof User) {
            return;
        }

        if ($user->isSuspended()) {
            throw new CustomUserMessageAccountStatusException('Your account is suspended.');
        }
    }
}
 Configuration: Symfony inatumia maandishi ya makundi ya kutekeleza Hata hivyo, unapaswa kuunganisha wazi katika firewall. UserCheckerInterface security:
    firewalls:
        main:
            lazy: true
            provider: app_user_provider
            user_checker: App\Security\UserEnabledChecker
 Verification: Kuingia kama mtumiaji sahihi. Bendera ya katika database. Upya ukurasa. Unapaswa kuingia nje mara moja na kuhamishwa kwenye ukurasa wa kuingia na ujumbe wa makosa. is_suspended true Mtumiaji wa Switch (Switch User) Kuruhusu watendaji "kuwa" watumiaji wengine kurekebisha matatizo. Configuration: security:
    firewalls:
        main:
            switch_user: true 
    
    role_hierarchy:
        ROLE_ADMIN: [ROLE_ALLOWED_TO_SWITCH]
 Restrict Target Users (Optional but Recommended): Kwa kawaida huna haja ya msimamizi kuonyesha Super Admin. . Event Listener namespace App\EventListener;

use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\Event\SwitchUserEvent;

#[AsEventListener(event: SwitchUserEvent::class, method: 'onSwitchUser')]
class SwitchUserListener
{
    public function onSwitchUser(SwitchUserEvent $event): void
    {
        $targetUser = $event->getTargetUser();

        if ($targetUser !== null && in_array('ROLE_SUPER_ADMIN', $targetUser->getRoles())) {
            throw new AccessDeniedException('Cannot impersonate Super Admins.');
        }
    }
}
 Verification: Kama mtaalamu wa utafiti, unapaswa kutembelea? Bar ya zana inapaswa kuonyesha "Impersonating". Tembelea ?_switch_user=_exit ili kurudi. _switch_user=someuser@example.com _switch_user=someuser@example.com kwa ujumla Usimamizi wa Upatikanaji wa Upatikanaji na Maoni Wakati mwingine, ROLE_ADMIN haitoshi katika access_control. Unahitaji mantiki kama "Admins kutoka IP 10.0.0.1" au "Watumiaji na header maalum". security: 
    access_control:
        - { path: ^/api, roles: ROLE_USER }
        - { path: ^/admin/sensitive, allow_if: "is_granted('ROLE_ADMIN') and request.getClientIp() in ['127.0.0.1', '::1']" }
 Verification: Jaribu kupata kutoka kwa IP tofauti (au kuchanganya IP katika mtihani). Inapaswa kuzuia upatikanaji hata kama una . /admin/sensitive ROLE_ADMIN Uchunguzi wa Usalama wa Logging kupitia Matukio Usalama ni kamili bila ufuatiliaji. Unapaswa kurekodi maombi ya mafanikio, kushindwa na kuruhusiwa kufikia matukio. namespace App\EventSubscriber;

use Psr\Log\LoggerInterface;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
use Symfony\Component\Security\Http\Event\LoginFailureEvent;
use Symfony\Component\Security\Http\SecurityEvents;

readonly class SecurityAuditSubscriber implements EventSubscriberInterface
{
    public function __construct(private LoggerInterface $securityLogger) {}

    public static function getSubscribedEvents(): array
    {
        return [
            SecurityEvents::INTERACTIVE_LOGIN => 'onLoginSuccess',
            LoginFailureEvent::class => 'onLoginFailure',
        ];
    }

    public function onLoginSuccess(InteractiveLoginEvent $event): void
    {
        $user = $event->getAuthenticationToken()->getUser();
        $this->securityLogger->info('User Login Success', [
            'username' => $user->getUserIdentifier(),
            'ip' => $event->getRequest()->getClientIp(),
        ]);
    }

    public function onLoginFailure(LoginFailureEvent $event): void
    {
        $this->securityLogger->warning('User Login Failure', [
            'ip' => $event->getRequest()->getClientIp(),
            'error' => $event->getException()->getMessage(),
            'passport' => $event->getPassport()?->getUser()->getUserIdentifier(),
        ]);
    }
}
 Verification: Tafuta faili yako ya kumbukumbu (tail -f var/log/dev.log) na uendesha login. Utaona orodha ya kumbukumbu ya JSON iliyoundwa kwa tukio la uhakiki. Mwisho wa Sehemu ya Usalama wa Symfony imekuwa na sifa ya kuwa mojawapo ya sehemu ngumu zaidi za mfumo. Hata hivyo, kama tulivyochunguza katika mifano haya kumi, ugumu huo hutafsiri moja kwa moja katika udhibiti wa granular na ufanisi wa kiwango cha kampuni. Katika Symfony 7.4, usalama sio tu juu ya kuzuia upatikanaji usioidhinishwa wa URL. Ni juu ya kuunda uzoefu usiofaa wa mtumiaji - iwe kwa njia ya viungo vya kichawi ambavyo hupunguza kizuizi, Impersonation ambayo huwezesha timu za usaidizi, au Rate Limiters ambayo bila shaka inalinda miundombinu yako. Kwa kuhamia zaidi ya kawaida form_login na kuchukua zana kama vile Voters, Custom UserCheckers, unabadilisha mantiki ya usalama nje ya maagizo yako na katika darasa maalum, inaweza kupimwa. Hii inafuata falsafa ya msingi ya maendeleo ya PHP ya kisasa: disconnecting. maagizo yako yanaendelea kidogo, mantiki yako ya biashara inabaki safi, na sera zako za usalama zinageuka kuwa rasilimali zinazotumiwa badala ya checks ngumu. Wakati wa kutekeleza miundo haya, kumbuka kuwa usalama sio kipengele unachoweza kuongeza mwishoni; ni kiwango cha usanifu unachofanya kutoka mwanzo. Unaweza kupata utekelezaji kamili na kufuata maendeleo ya mradi kwenye GitHub: [ ] Source Code: https://github.com/mattleads/SecurityPatterns https://github.com/mattleads/SecurityPatterns Let’s Connect! Ikiwa umeona hii inasaidia au una maswali kuhusu utekelezaji, ningependa kusikia kutoka kwako. 
 
 
 
 
 Linkedin: [https://www.linkedin.com/in/matthew-mochalkin/] Mtandao wa Mtandao (Twitter): [https://x.com/MattLeads] Mtandao wa Mtandao: [https://t.me/MattLeads] GitHub: [https://github.com/mattleads] https://www.linkedin.com/in/matthew-mochalkin/ https://x.com/MattLeads https://t.me/MattLeads https://github.com/mattleads

This story contains AI-generated text. The author has used AI either for research, to generate outlines, or write the text itself. 

Read My Stories

Sauti hii imetolewa katika lugha asilia ya hadithi!

10 Teknolojia katika Symfony ambayo itakusaidia kuwa salama kama mtaalamu

About Author

MAONI

HANG TAGS

MAKALA HII ILIWASILISHWA NDANI

Related Stories

Sweet Security Unveils First Unified Detection And Response Platform

Master Crypto Security: Your Complete Guide to Safe Wallet Management

Jinsi $ TRUTH token ya Swarm Network inapanga kukabiliana na taarifa mbaya kupitia uhakiki wa Blockchain

Details of the Aerial Voyage.—Kennedy silenced

Sweet Security Unveils First Unified Detection And Response Platform

Master Crypto Security: Your Complete Guide to Safe Wallet Management

Jinsi $ TRUTH token ya Swarm Network inapanga kukabiliana na taarifa mbaya kupitia uhakiki wa Blockchain

Details of the Aerial Voyage.—Kennedy silenced

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps