I-Component ye-Symfony Security isetyenziswa ngokubanzi, isetyenziswa kuphela njenge- "login gateway." Kwimeko, i-framework ye-authorization epheleleyo enokufanelekileyo yokusebenza kunye namatshini ezinxulumeneyo, izicelo ze-hierarchical, kunye ne-stateless authentication flow. Le nqakraza ibandakanya iimveliso ezidlulileyo ze-10 usebenzisa i-Symfony 7.4. I-Stateless API Authentication nge-AuthenticationEntryPointInterface Izicelo ezintsha ziquka i-API ye-stateless kunye ne-frontend ye-stateful. Ukususela kwi-Symfony 6.2+, i-AuthenticationEntryPointInterface yindlela yokufanisa i-API tokens (i-JWT, i-Opaque, njl) ngaphandle kokufumana i-Guardi authenticators ezidlulileyo. Nceda ukhuseleko iindlela ezantsi Ukusebenzisa i i-token, ukuguqulwa kwi-database okanye inkonzo ye-external, ngokugqithiselwe ngokupheleleyo kwi-session. Scenario: /api Bearer Create the Authenticator: namespace App\Security;

use App\Repository\ApiTokenRepository;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;

use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;

class ApiTokenAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface
{
    public function __construct(private readonly ApiTokenRepository $apiTokenRepository)
    {
    }

    public function supports(Request $request): ?bool
    {
        return $request->headers->has('Authorization') && str_starts_with($request->headers->get('Authorization'), 'Bearer ');
    }

    public function authenticate(Request $request): Passport
    {
        $apiToken = substr($request->headers->get('Authorization'), 7);
        if (null === $apiToken) {
            throw new CustomUserMessageAuthenticationException('No API token provided');
        }

        $token = $this->apiTokenRepository->findOneBy(['token' => $apiToken]);
        if (null === $token || !$token->isValid()) {
            throw new CustomUserMessageAuthenticationException('Invalid API Token');
        }

        return new SelfValidatingPassport(new UserBadge($token->getOwner()->getUserIdentifier()));
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        return null;
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
    {
        $data = ['message' => strtr($exception->getMessageKey(), $exception->getMessageData())];

        return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
    }

    public function start(Request $request, AuthenticationException $authException = null): Response
    {
        return new JsonResponse(['message' => 'Authentication Required'], Response::HTTP_UNAUTHORIZED);
    }
}
 Configure security.yaml:         api:
            pattern: ^/api
            stateless: true
            custom_authenticators:
                - App\Security\ApiTokenAuthenticator
            entry_point: App\Security\ApiTokenAuthenticator
 Verification: Yenza isicelo se-cURL. Uya kufuneka ufumane i-401 ngaphandle kwe-header kunye ne-200. curl -I -H "Authorization: Bearer YOUR_VALID_TOKEN" http://localhost:8080/api/profile
 I-Passwordless “Magic Link” Ukubhalisa Ukuncedisa ukusetyenziswa, ungenza ukunceda abasebenzisi ukufikelela ngokuchofoza ikhonkco efumaneka kwi-imeyili zabo, ukuchitha i-passwords ngokupheleleyo. Ukulungiselela i-Authenticator: Ukuvumela i-native login_link authenticator.             login_link:
                check_route: login_check
                signature_properties: ['id', 'email']
                lifetime: 600
 Generate and Send the Link: Ngo controller yakho: namespace App\Controller;

use App\Repository\UserRepository;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Notifier\NotifierInterface;
use Symfony\Component\Notifier\Recipient\Recipient;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface;
use Symfony\Component\Security\Http\LoginLink\LoginLinkNotification;

class SecurityController extends AbstractController
{

    #[Route('/login/link', name: 'login_link_start', methods: ['GET', 'POST'])]
    public function requestLink(
        Request $request,
        LoginLinkHandlerInterface $loginLinkHandler,
        NotifierInterface $notifier,
        UserRepository $userRepository
    ): Response {
        if ($request->isMethod('POST')) {
            $email = $request->request->get('email');
            $user = $userRepository->findOneBy(['email' => $email]);

            if ($user) {
                $loginLinkDetails = $loginLinkHandler->createLoginLink($user);

                $notification = (new LoginLinkNotification(
                    $loginLinkDetails,
                    'Welcome back! Click to login.'
                ));
                $notifier->send($notification, new Recipient($user->getEmail()));

                // For demonstration, we'll dump the link to the profiler instead of sending an email.
                // In a real app, you'd remove this.
                $this->addFlash('success', 'Login link sent! Check the profiler for the link.');
                $this->addFlash('login_link', $loginLinkDetails->getUrl());
            }

            return $this->render('security/link_sent.html.twig');
        }

        return $this->render('security/request_login_link.html.twig');
    }

    #[Route('/login/check', name: 'login_check')]
    public function check(): void
    {
        throw new \LogicException('This controller should not be reached!');
    }
}
 Verification: Yenza ifomu. Qhagamshelana ne-mailer yakho (isib. i-messenger okanye i-local logs). Qhagamshelana ne-links eyenziwe. Uya kufuneka uqhagamshelane ngokuzenzekelayo. Dynamic Role Hierarchy ukusuka Database Iingxowa ze-Symfony ze-Standard zihlanganiswa ngokugqithisileyo Iimpawu ze-Enterprise ziquka izicelo ze-Roles ze-Dynamic ezibonakalayo nge-Admin UI. security.yaml Ukukhanyisa i iinkonzo security.role_hierarchy Create the Decorator namespace App\Security;

use App\Repository\RoleRepository;
use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
use Symfony\Component\Security\Core\Role\RoleHierarchy;
use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;

#[AsDecorator('security.role_hierarchy')]
class DatabaseRoleHierarchy implements RoleHierarchyInterface
{
    private RoleHierarchyInterface $mergedHierarchy;

    public function __construct(
        // The decorated service is not used, but is required for the decorator pattern
        RoleHierarchyInterface $inner, 
        array $staticHierarchy,
        private readonly RoleRepository $roleRepository
    ) {
        $dbHierarchy = $this->roleRepository->findAllHierarchy();

        // array_merge_recursive can have unexpected results with numeric keys, but it's fine for role strings.
        $merged = array_merge_recursive($staticHierarchy, $dbHierarchy);

        $this->mergedHierarchy = new RoleHierarchy($merged);
    }

    public function getReachableRoleNames(array $roles): array
    {
        return $this->mergedHierarchy->getReachableRoleNames($roles);
    }
}
 Verification: Yenza i-Custom Role ukuba umqhubi kwi-DB. Qinisekisa Iimveliso ekubeni database yakho. Ngena & Dump Ingaba kufuneka ubone iimfuno ezidlulileyo ezibonakalayo ngokuzenzakalelayo. ROLE_SUPER_MANAGER ROLE_SUPER_MANAGER ROLE_ADMIN $user->getRoles() I-Complex Business Logic nge-Voters kunye ne-Attributes Ukusetyenziswa kwe-Controller. Ukusetyenziswa kwe-Voters. Kwi-Symfony 7.4, sinokufumanisa kunye neengxaki ezizodwa kunye neengxaki ze-Clean Code. #[IsGranted] Umdlali angakwazi ukulungiselela Post kuphela ukuba bafumene i-Author okanye ukuba bafumene i-Editor kunye ne-Post "I-Published" (nakuba akukho-Draft). The Voter: namespace App\Security\Voter;

use App\Entity\Post;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class PostVoter extends Voter
{
    public const string EDIT = 'POST_EDIT';

    protected function supports(string $attribute, mixed $subject): bool
    {
        return $attribute === self::EDIT && $subject instanceof Post;
    }

    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
    {
        $user = $token->getUser();
        if (!$user instanceof User) {
            return false;
        }

        /** @var Post $post */
        $post = $subject;

        // Rule 1: Author can always edit
        if ($post->getAuthor() === $user) {
            return true;
        }

        // Rule 2: Editors can only edit if Published
        if (in_array('ROLE_EDITOR', $user->getRoles()) && $post->isPublished()) {
            return true;
        }

        return false;
    }
}
 The Controller: namespace App\Controller;

use App\Entity\Post;
use App\Security\Voter\PostVoter;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;

class PostController extends AbstractController
{
    #[Route('/post/{id}/edit', name: 'post_edit')]
    #[IsGranted(PostVoter::EDIT, subject: 'post')]
    public function edit(Post $post): Response
    {
        return $this->render('post/edit.html.twig', [
            'post' => $post,
        ]);
    }
}
 Verification: Ufuna ukufikelela kwi-route ye-editing njenge-non-author kwi-Draft post. Uya kuba . 403 Access Denied Ukulungiselela ukuxhaswa kweLogin I-Brute Force Protection yintloko. I-Symfony ibandakanya i-RateLimiter ngqo kwi-firewall. Configure Rate Limiter: # config/packages/security.yaml
security:
    firewalls:
        main:
            login_throttling:
                max_attempts: 3
 Verification: Ukusabela ukuqhagamshelane nge-password efanelekileyo iiyure ezimbini ngexesha elifanelekileyo. I-4. ingxaki, ukuvimbela ukuyifaka ukuyifaka i-database. 429 Too Many Requests Programmatic Login (Auto-login emva kokufikelela) Emva kokubhalisa umxokozelo, ukhangela ukuyifaka i-password yayo ngokugqithisileyo. Ungasebenzisa i-Security helper, unako ukuyifaka ngokugqithisileyo. namespace App\Controller;

use App\Entity\User;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
use Symfony\Component\Routing\Attribute\Route;

class RegistrationController extends AbstractController
{
    #[Route('/register', name: 'app_register', methods: ['GET', 'POST'])]
    public function register(
        Request $request,
        UserPasswordHasherInterface $passwordHasher,
        EntityManagerInterface $entityManager,
        Security $security
    ): Response
    {
        if ($request->isMethod('POST')) {
            $email = $request->request->get('email');
            $password = $request->request->get('password');

            $user = new User();
            $user->setEmail($email);
            $user->setPassword($passwordHasher->hashPassword($user, $password));

            $entityManager->persist($user);
            $entityManager->flush();

            return $security->login($user,'security.authenticator.form_login.main');
        }

        return $this->render('registration/register.html.twig');
    }
}
 Verification: Qinisekisa ukuba uqhagamshelane ngokuzenzakalelayo kwi-dashboard kwaye i-profile ibonisa ukuba uqhagamshelane. Ukunciphisa abasebenzisi abalandeli (User Checkers) Ukuba utshintshe umxhasi kwi-database, ungenza ukuqhagamshelane ukuba i-session yayo ifumaneka. isebenza kwi-request for every active session. UserChecker namespace App\Security;

use App\Entity\User;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
use Symfony\Component\Security\Core\User\UserCheckerInterface;
use Symfony\Component\Security\Core\User\UserInterface;

class UserEnabledChecker implements UserCheckerInterface
{
    public function checkPreAuth(UserInterface $user): void
    {
        if (!$user instanceof User) {
            return;
        }

        if ($user->isDeleted()) {
            throw new CustomUserMessageAccountStatusException('Your account has been deleted.');
        }
    }

    public function checkPostAuth(UserInterface $user): void
    {
        if (!$user instanceof User) {
            return;
        }

        if ($user->isSuspended()) {
            throw new CustomUserMessageAccountStatusException('Your account is suspended.');
        }
    }
}
 Configuration: I-Symfony itheyibhile ngokuzenzakalelayo izifundo ezisebenza Nangona kunjalo, kufuneka uqhagamshelane ngqo kwi-firewall. UserCheckerInterface security:
    firewalls:
        main:
            lazy: true
            provider: app_user_provider
            user_checker: App\Security\UserEnabledChecker
 Verification: Ngena njenge-user efanelekileyo. Qhagamshelana ngqo Iimpawu ze kwi-database. Ukukhishwa kwiphepha. Uya kufuneka uqhagamshelane ngokuzenzakalelayo kwaye uqhagamshelane kwi-login page kunye ne-error message. is_suspended true Impersonation (Umsebenzisi yeSwitch) Yenza ama-admin ukuba "ngaba" abasebenzisi abaninzi ukuba bafumane iinkcukacha. Configuration: security:
    firewalls:
        main:
            switch_user: true 
    
    role_hierarchy:
        ROLE_ADMIN: [ROLE_ALLOWED_TO_SWITCH]
 Restrict Target Users (Optional but Recommended): Ingaba ufuna ukuba umlawuli wabelane umlawuli we-Super Admin. . Event Listener namespace App\EventListener;

use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\Event\SwitchUserEvent;

#[AsEventListener(event: SwitchUserEvent::class, method: 'onSwitchUser')]
class SwitchUserListener
{
    public function onSwitchUser(SwitchUserEvent $event): void
    {
        $targetUser = $event->getTargetUser();

        if ($targetUser !== null && in_array('ROLE_SUPER_ADMIN', $targetUser->getRoles())) {
            throw new AccessDeniedException('Cannot impersonate Super Admins.');
        }
    }
}
 Verification: Njengomfanekiso admin, ukufumana? . I-Toolbar kufuneka ibonisa "Impersonating". Qhagamshelana ?_switch_user=_exit ukuze ufike. _switch_user=someuser@example.com _switch_user=someuser@example.com I-Access Control Complex kunye ne-Expressions Kwiimeko, ROLE_ADMIN ayikho kakhulu kwi-access_control. Ufuna i-logic efana ne-"Admins from IP 10.0.0.1" okanye ne-"Users with a specific header". security: 
    access_control:
        - { path: ^/api, roles: ROLE_USER }
        - { path: ^/admin/sensitive, allow_if: "is_granted('ROLE_ADMIN') and request.getClientIp() in ['127.0.0.1', '::1']" }
 Verification: Thola ukufikelela ukusuka kwi-IP eyahlukileyo (okanye ukubheja i-IP kwi-test). Yintoni kufuneka uqhagamshelane ukufikelela . /admin/sensitive ROLE_ADMIN I-Security Audit Logging nge-Events Ukhuseleko ayinempumelelo ngaphandle kwe-observability. Uya kufuneka uqhagamshelane iingxaki ezisebenzayo, iingxaki kunye neengxaki ze-access. namespace App\EventSubscriber;

use Psr\Log\LoggerInterface;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
use Symfony\Component\Security\Http\Event\LoginFailureEvent;
use Symfony\Component\Security\Http\SecurityEvents;

readonly class SecurityAuditSubscriber implements EventSubscriberInterface
{
    public function __construct(private LoggerInterface $securityLogger) {}

    public static function getSubscribedEvents(): array
    {
        return [
            SecurityEvents::INTERACTIVE_LOGIN => 'onLoginSuccess',
            LoginFailureEvent::class => 'onLoginFailure',
        ];
    }

    public function onLoginSuccess(InteractiveLoginEvent $event): void
    {
        $user = $event->getAuthenticationToken()->getUser();
        $this->securityLogger->info('User Login Success', [
            'username' => $user->getUserIdentifier(),
            'ip' => $event->getRequest()->getClientIp(),
        ]);
    }

    public function onLoginFailure(LoginFailureEvent $event): void
    {
        $this->securityLogger->warning('User Login Failure', [
            'ip' => $event->getRequest()->getClientIp(),
            'error' => $event->getException()->getMessage(),
            'passport' => $event->getPassport()?->getUser()->getUserIdentifier(),
        ]);
    }
}
 Verification: Tail ifayile yakho lokubhaliweyo (tail -f var/log/dev.log) kwaye usebenze login. Uya kuza ingxaki lokubhaliweyo ye-JSON ye-event yokuqinisekisa. Ukucinga I-Symfony Security i-component iye yenzelwe ngexesha elide ukuba yenye iindawo ezininzi ze-framework. Nangona kunjalo, njengoko siqhathanisa kwiimveliso ezine ze-10, le ngempumelelo ifumaneka ngqo kwi-control granular kunye ne-flexibility ye-enterprise-grade. Kwi-Symfony 7.4, ukhuseleko akuyona kuphela ukunciphisa ukufikelela okungagunyaziswanga kwi-URL. Izixhobo zokusebenza ngokugqithisileyo - okanye ngokusebenzisa i-Magic Links ezincinciphisa ukuchithwa, i-Impersonation enikezela amaqela zokuxhumana, okanye i-Rate Limiters enikezela ngokucacileyo i-infrastructure yakho. Ngaphandle kweform_login yamagama kunye nokuvelisa izixhobo ezifana neVoters, UserCheckers Custom, unxibelelanisa i-logic yobugcisa kwi-controller yakho kwaye kwi-classes ezizodwa, ezibonakalayo. Oku ibandakanya i-philosophy core ye-modern PHP development: unxibelelanisa. I-controller yakho ibekwe ezincinane, i-logic yakho yobugcisa, kwaye i-policy yakho yobugcisa ziye ziye ziye ziye ziye ziye ziye ziye ziye zibonakalayo. Xa uqhagamshelane iimfashini ezidlulileyo, sicela ukunceda ukuba ukhuseleko ayinxalenye ekugqibeleni; kuyinto umgangatho we-architectural uqhagamshelane ukusuka ekuqaleni. Uyakwazi ukufumana ukulungiselela ngokupheleleyo kunye nokulandela imveliso yeprojekthi kwi-GitHub: [ ] Source Code: https://github.com/mattleads/SecurityPatterns https://github.com/mattleads/SecurityPatterns Let’s Connect! Ukuba ufumane le nceda okanye unayo imibuzo malunga nenkqubo yokusebenza, ndifuna ukufumana kwakhona. Thina siphinde nqakraza kunye nokufutshane kwiifowuni ezininzi: 
 
 
 
 
 LinkedIn: [https://www.linkedin.com/in/matthew-mochalkin/] X (Twitter): [https://x.com/MattLeads] Umxholo: [https://t.me/MattLeads] GitHub: [https://github.com/mattleads] https://www.linkedin.com/in/matthew-mochalkin/ https://x.com/MattLeads https://t.me/MattLeads https://github.com/mattleads

This story contains AI-generated text. The author has used AI either for research, to generate outlines, or write the text itself. 

Read My Stories

Le audio iveliswe ngolwimi lokuqala lwebali!

I-10 Techniques kwi-Symfony eziza kukunceda ukhuseleko njenge-Pro

About Author

IZIMVO

ZIJONGE IIMPAWU

ELI NQAKU LINIKEZELWE KU

Related Stories

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps