Symfony 3 Security: Beautiful Authentication, Powerful Authorization

lets hope the rest comes soon enough!

Hey Chen!

Ah, thank you! I think this a great topic - more and more people are asking for something like this. Which parts are most important to you? Tuning the bottom-line speed of each request? Caching? Something else?

I'm adding it to our list right now :).

Cheers!

Hi Ryan, thanks for the reply. I think I have got some real world examples for you and this might be (may not be) seem like a challenge... But we'll be so happy if you accept this challenge; BTW, will it be possible to experimenting them on Symfony3 framework as well? Many thanks and the best regards! :-)

Push it to the limits - Symfony2 for High Performance needs:
http://symfony.com/blog/pus...

Handling 1 Billion requests a week with Symfony2:
http://labs.octivi.com/hand...

The Easy Way Of Building A Growing Startup Architecture Using HAProxy, PHP, Redis And MySQL To Handle 1 Billion Requests A Week:
http://highscalability.com/...

These are awesome resources - thanks for sharing them :). And yes, we would definitely do this on Symfony 3!

Hey, Julian!

What about the second problem, it's difficult to understand from your message without proper formatting, but I was tricky and was able to see what's the problem :) You placed anonymous key under logout but should under your firewall name like:

your_firewall_name:
    logout:
        path:   /logout
        target: /log_index
    anonymous:    true

Please, fix it first and let me know if your first issue still exist.

Cheers!

Thanks a lot dude! It was definitly my own YML mistake. I just have still a routingproblem. When my auth_token is set Annonymous my project is still rendering the default login form. When I have authorization he renders the show.html I just want to have rendered there ;). My dream is to render the log_index.html if a user logsout or is at the Annonymous-Status.

Hey, do you consider isGranted('IS_AUTHENTICATED_REMEMBERED')? It returns true for all logged in users, even if they are logged in because of a "remember me cookie". (Notice that I don't use negation (! sign) in if statement):

    public function loginAction()
    {
        if ($this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_REMEMBERED')) {
            return $this->render('MainBundle:Default:show.html.twig');
        }

        return $this->render('MainBundle:Default:log_index.html.twig');
    }

Please, let me know if it helps you!

This works the same way as the Controller before. There is still a default render to /login but I will check out now how to customize the Routes after a logout. Thank you so much and I'm also thankfull for any further advices!

Ah, OK!

If you have not found any solution yet, could you explain me again what exactly don't work as you want in this code? I'll try to help you with it too.

Cheers!

BTW, you could check full security reference here http://symfony.com/doc/current/reference/configuration/security.html#full-default-configuration, or just use Symfony console command:

bin/console config:dump-reference security```

Hey Paweł C.

In that case you could use AWS S3 service for data storage, or, if you are storing files locally, then, you may want to store them out of the web directory and then create a controller's action that will *do* that "serving" logic (There is where you can check roles)

Cheers!

Hey Mamadou,

Thanks for your kind words! You can wait for this new course based on Symfony 4 and our brand Stellar project, we're really want to release it soon, but I have no estimations yet. So, if you impatient, you can start with this one - the code is almost the same, well, except that you need to do it in a Symfony 4 way with Symfony Flex, you know, installation process and file structure are a bit different in Symfony 4. If you find any issues with Symfony 4 - let us know in comments section and we'll help you.

Cheers!

Hi Yoni!

We don't have an active plan to talk about translations, but it's a good topic! I would love to know what specific pieces were most difficult for you - we could use that to plan the tutorial!

Cheers!

Ok, to begin, most of the tutorials available describe how to use translator from scratch [http://symfony.com/doc/2.8/...], but the translator service is already active and the name is "translator.default" for injection.

- The fact that symfony can manage and create the file they are always talking about in that tutorials (xml, po, array...) with the console.

I know that we can use anything to render view but we can suppose that we use the excellent twig part.
I use {%trans%} in twig, how to generate easily the translation file in fr_FR and en_GB for example and where is it created?
I was force to google that (or Bing or yahoo...) to finaly understand: It's so easy...
- the translation folders which is a very sensitive point of 3 lines in the doc

If i was looking for a tutorial, I would like to have:
- quick overview of the global process
- (how to) the front end translation (twig),
- (how to) the back end translation (for api, ajax, error thrown...).
- the awesome translation file generation and the console debuging.
- ice on the cake for fun: custom translator with twig filter.

Often when already have some text to translate, and the official doc is beginning at the opposite of that.
Do we have a sugestion page on the KnPU site with vote?

Thank you so much for this! And you also highlighted some problems with the official docs that we can fix :).

I have added this to our internal screencast idea list. There's no public place to vote for ideas currently. Well, no "official" place - often times people click the "Ideas or Feedback" button on the bottom right of the page and add the idea there. Other people vote on those. We've been thinking about adding a proper spot on the site - it would be great to crowdsource what people are having most trouble with!

Cheers!

This will be released the week after next (so about 9 days) - but parts of it may be released next week :)

Thats amazing! indeed would be awesome to be able to start even without the screencast, with the scripts maybe?

We'll have a script content without code blocks first. Code blocks will be added a bit later, after screencasts.

Aaawesome :)

I have a few other tutorials scheduled before this one, so it won't be in April :/. BUT, *very* soon, we'll be releasing the new Symfony REST course about security, and I think you might be able to use some good things from it :). http://knpuniversity.com/sc...

If you hit the "Notify me" button at the top - we'll send you a one-time email when this course comes out.

Cheers!

So glad you asked :). Yes, definitely June, hopefully early. I've already coded it up and will start recording soon (just need to get forms and Symfony REST part 5 out the door first).

Hey Javier!

Are you looking for this? http://knpuniversity.com/sc... Or something else?

Let me know, and cheers!

Hey Gunnar,

Good question! You can take a look at FOSUserBundle which already has this functionality implemented out of the box, you just need to enable it. If you do not want to install an entire bundle and you've already implemented login/register features by yourself, well, you can grab some already written logic from FOSUserBundle to implement password resetting by yourself. But the concept is simple: when user request a password reset for his email - you need to generate a unique ID generally called "token", e.g. an md5 hash for that user. It's a good idea to add some kind of TTL for this token to make it token not active after a while for security reasons. This token should be sent to user's email as a link, and when user click this link - if token is valid and not expired - you show a password reset form, i.e. a new password field, or 2 fields: "new password" and "confirm new password". When user enter a new password - encrypt and store it in DB, also clearing the password resetting token for security reasons.

Cheers!

Hey sasa1007

I'm not sure if this is the best way todo it but at least it will give you the flexibility that you require.
If you make use of the "always redirect to the default page" system, then you can implement a custom route action that will work as a central entry point, where you can implement all the logic required to decide the proper redirection
https://symfony.com/doc/cur...

Cheers!

Yo Lee!

Haha, sorry to disappoint ;). Once you've got authenticators down, you're a pro. Well, there's *always* more to security :).

I just left a comment on your SO - it's definitely something minor: based on your post, I think you understand things really well. I actually *always* call persist() - even though I don't need to - so I'm less familiar with what might ultimately be causing it.

Cheers!

Thanks Ryan! I really appreciate you taking the time to look at it.

I finally decided to remove the doctrine Password Hash Listener and encode the passwords at an other place. This works fine. I am still curious about what the cause of the issue is though. Doctrine scares me.

That's probably not a bad idea - I try to avoid Doctrine listeners if I can, and instead do work in services, and call those services when needed. Doctrine is great, but Doctrine listeners are a weird place, where you're already right in the middle of saving something. Not a bad policy to avoid :).

Cheers!

Hey Vlad!

This is something we're actually working on right now (and your feedback about what you need on the certificate is very useful!). But, we'd be happy to make a certificate for you before then so you have it. Just send us an email (hello@unviersity.com) with the details (e.g. your full name).

Happy this topic hit on your continuing ed requirements - that's awesome :).

Cheers!

Thank you, Ryan, that's great! I'll shoot you an email, once I finish the course!

Hey fredrsf ,

Did you see the latest chapter in this course: <a href="https://knpuniversity.com/screencast/symfony-security/automatic-login-handling&quot;&gt; Automatically Login after Registration</a>. It explain how to do it, except that you should wrap $this->get('security.authentication.guard_handler')->authenticateUserAndHandleSuccess(...) call with additional condition:

if ($request->isXmlHttpRequest()) {
    return $this->get('security.authentication.guard_handler')
        ->authenticateUserAndHandleSuccess(...);
}

If you'll send an AJAX request - isXmlHttpRequest() returns true in this case. And don't forget to handle that case when you have a normal (not AJAX) request.

Cheers!