Denying Access in a Controller

Hey Roel,

Have you tried it? Actually, Symfony has this feature out-of-the-box! :) You just need to properly configure your firewall in security.yml file.

Cheers!

Hi Victor,

Yes, I tried it. When I browse as an anonymous user to /user/create I get a 404 No route found for "GET /user/create".
In my security.yml I've added 'access_denied_url: /login' in firewalls > main. Is this the out-of-the-box feature you're referring to?

Cheers,
R.

No, it's something different. How do you restrict access to this page? Is your anonymous user authenticated on /user/create page? You can check it in web debug toolbar, you should see there:

Logged in as: anon.
Authenticated: Yes
Token class: AnonymousToken

Cheers!

Hi Victor,

I've added this to the top of my UserController:

/**
* @Security("is_granted('ROLE_HR')")
* @Route("/user")
*/

class UserController extends Controller

When a go to /user/create with an un-authenticated user, the web debug toolbar shows me "n/a - You are not authenticated".

Cheers,
Roel

Great! That's the point I think. So you need to authenticate user on every page, for it you need to specify "pattern: ^/" in the main firewall:

security:
    firewalls:
        main:
            pattern: ^/
            anonymous: true

Do you have these lines in your firewall? Also what's in your access_control list of security.yml?

Cheers!

Thanks! I've added these lines now to my main firewall in security.yml. Still get the 'no route found for "GET /user/create" error. The access_control list is currently empty.

Cheers!

Hey Roel!

Hmm! So, a couple of things to try here:

1) The "404 No Route Found GET /user/create" literally means what it says: this error has nothing to do with security or being denied access. It is actually saying (independent of security) "I don't see any route for /user/create". Try running a bin/console debug:router to see what URLs you have - something must be slightly misconfigured here in your routing configuration.

2) Once we have (1) figured out (first priority!) then we can "lock" things down with security. The feature that Victor is talking about is mentioned here (it's an older, Symfony 2 tutorial - but this hasn't changed): http://knpuniversity.com/screencast/symfony2-ep2/secure-every-page. Make sure to remove that access_denied_urls thing - that's not needed. Your firewall should look a bit like what Victor posted (https://knpuniversity.com/screencast/symfony-security/deny-access-inside-controller#comment-2982576414) except after anonymous, you will configure whatever login mechanisms you need (e.g. form_login, guard, http_basic, whatever). You won't have anything under your firewall that actually denies access in any way - that'll happen under access_control. Once you have this, an anonymous user who tries to visit any page that requires login will automatically be redirected to /login: that's a natural feature of Symfony (of course, you can configure exactly where they're redirected: but Symfony always redirects the user to the "login" page if it detects that an anonymous user is trying to access a protected page).

Let us know if that helps! And cheers back!

Yo Ryan!

Thanks for the debug:router tip! At the top of my UserController, I somehow added @Route("/user") which turned my routes into /user/user/create. Simply removed this and now I'm nicely redirected to /login when I try to access /user/create with an unauthenticated user.

Thanks a bunch!

Cheers,
R.

Yep, I've done that before ;). Glad it helped and good luck!

Hey Ahmedbhs,

Using the "has_role()" function in security expressions is deprecated since Symfony 4.2, use "is_granted()" instead.

Cheers!

Hey Lavin

By passing an array of ROLES you are saying that it will be granted if the logged in user has any of those roles but not both are required. If you want to check for both, there are many ways to do it, like creating your own voter, or just checking one role at a time

$this->denyAccessUnlessGranted('ROLE_CUSTOMER_SERVICE');
$this->denyAccessUnlessGranted('ROLE_POINT_OF_SALES');

or changing the default "decision strategy" to unanimous

Cheers!

hi thank for the reply im still confuse because right now its still can bypass by access the url,i done changing the $this->denyAccessUnlessGranted into seperate one like the example you give

What roles does your user owns? How's structured your role hierarchy?

ive solved maybe the solution its not the correct way i add this line in angular-jwt.js in code line when user got error message 403 'you got no access' add this code $state.go('dashboard');

Hey Richard ,

Thanks for this tip ;)

Cheers!

Yo Teolan,

Actually, $credentials can be anything you want, but except the null value. If getCredentials() returns a non-null value, then the getUser() method is called and its return value is passed here as the $credentials argument. So from getCredentials() method you can return just a token string, or an array of entered username and password by user - no matter, you just have to handle this credentials in getUser method. That's why getUser() method doesn't have a typehint for $credentials - it can be any type. So as you see there's no magic ;)

You can see the description of these methods here: http://symfony.com/doc/curr...

Cheers!

Thanks Victor!

Yo Mike P.!

When you try to access a protected page as an anonymous user (e.g. /admin/genus), then the "entry point" of your firewall is called to determine what to do next. What the heck is an entry point? Well, each "method" of authentication - e.g. each guard authenticator of if you're using some core authentication methods, then each thing like form_login or http_basic - has an "entry point" - a method that simply returns what Response should be sent to the user in this situation. In our authenticator, the start() method is the entry point.

That's a long way of saying: when you go to /admin/genus as an anonymous user, then the start() method in your authenticator should be called and IT is determining what do send back to the user (in this case, it's redirecting to /login). But, if you have multiple authenticators or 1 authenticator and 1 other authentication mechanism (like form_login), then the entry point is only used from *one* of these. If I remember correctly, the start() method from your authenticator should win over the one in form_login. Let me know if this is your situation - other wise this last rambling is irrelevant :).

Cheers!

Perfect explanation! Ive seen now that start() is calling getLoginUrl() and there it is, the reason thy it redirects to /login:

    protected function getLoginUrl()

    {

        return $this->router->generate('security_login');

    }```


Many thanks Ryan!

Hey Yang!

Another good question :). Here's what I would do in Twig:

{% if is_granted('ROLE_ADD_COMMENT') %}

Then, you can use the role_hierarchy feature ( https://knpuniversity.com/screencast/symfony-security/role-hierarchy ) to give ROLE_USER and ROLE_AUTHOR this role:

role_hierarchy:
    ROLE_USER: [ROLE_ADD_COMMENT]
    ROLE_AUTHOR: [ROLE_ADD_COMMENT]

This should help keep things cleaner :).

And also, though you don't need it yet, you may eventually want to use voters: https://knpuniversity.com/screencast/new-in-symfony3/voter. This is needed when the access decision you need to make depends on some data - e.g. deciding whether or not a user can edit a blog post, which in your app, might be allowed only if the author if the blog post matches the current user. So, roles are for global permissions - "Can the user do ABC in general?" - but if you need object-specific permissions - "Can the user EDIT this specific object" - then look into voters.

Cheers!

Hey Cesar

Nice question. I have an idea but it depends on how much security do you need. My idea is to use obfuscation by creating a folder per each user and giving it a very hard guessing name, so only you can find those folders and files.
But, if what you need is something more bullet proof, then you can give it a try to this solution: https://stackoverflow.com/a...

Cheers!

so, now in my security.yml:

security:
role_hierarchy:
ROLE_AUHTOR: [ROLE_WRITE_POST, ROLE_WRITE_COMMENT]
ROLE_USER: [ROLE_WRITE_COMMENT]

(I checked here, its 4 spaces indented)

and in my twig:

{% if is_granted('ROLE_WRITE_POST') %}
New Post
{% endif %}
however, when I log in with a user with 'ROLE_AUTHOR', I can't see the button.
Just for testing,

{% if is_granted('ROLE_WRITE_POST') or is_granted('ROLE_AUTHOR') %}
New Post
{% endif %}
this is working fine. So, did I forget anything?

Ah, it's such a small detail! In your security.yml, you have ROLE_AUHTOR - it's a typo, should be ROLE_AUTHOR.

I bet that'll do it :)

Cheers!

holy shit... of course... the best(worst) ones are always the typos... I would never found it by myself o.O

OK - ignore me, wrong question, wrong place.. It's voters isn't it?

Thanks for some of the best courses anywhere.

Hey John,

Nice catch about voters! Yeah, voters are great and very flexible, and looks like it's exactly what you need if you want to flexibly secure something in your app, but the ROLE_* functionality isn't enough for you. However, there's also a concept about groups, if you use FOSUserBundle - check their docs to find more information and use cases about groups:
https://symfony.com/doc/mas...

P.S. If you don't use FOSUserBundle, well, you can get the idea of roles and easily implement them by yourself, just steal some code from the bundle ;)

Cheers!

Hi Victor,

I think after a few hours I've reimplemented what is probably in FOSUserBundle (although I've not gone and looked, and I've probably done it less well). I've created an event subscriber, and am using that to dynamically reload roles and linked it to kernel.controller - based on the group they are acting as a member of. So that deals with a 'group change' whether through a planned action, or through editing the browser bar.

It broke the web profiler for a bit, until I worked out how to exclude triggering my event when the web profiler controller ran.

so all good now, but it was an interesting journey.

Hey John,

As always, security is a complex stuff, but looks like you nailed it ;)
I'm glad to hear it helped you!

Cheers!

Hey Boran,

Could you explain a bit what're you trying to do? The @Security annotation throws exception like AccessDeniedHttpException, so users will see an Access Denied error with 403 status code. And you can override this Twig template to show a custom error page for this error. I hope it helps.

Cheers!

I'm trying to use @Security annotations for my routes. Like this:

/**
* @return Response
* @Route("/action")
* @Security("has_role('ROLE_USER')")
* @Template()
*/public function someAction(){
return array();}

When the security restriction fires an exception, I get the message Expression "has_role('ROLE_USER')" denied access.

This is not acceptable to be shown to the end user, so I'm trying to find a way to customize the message for annotation.

Simple workaround is to not to use @Secutity annotations and write code like these:

/**
* @return Response
* @Route("/action")
*
* @Template()
*/public function someAction(){
if (!$this->get('security.context')->isGranted('ROLE_USER')) {
throw new AccessDeniedException('You have to be logged in in
order to use this feature');
}

return array();}

But this is less convenient and less readable.

Is it possible to write custom message to @Security annotations?

Hey Boran,

At first, I see that we can't change this message with @Security annotation, but users won't see this "Expression "has_role('ROLE_USER')" denied access" message in production anyway - you see it only in dev mode. So the better and *easiest* option here is to override the default `error403.html.twig` template (or just error.html.twig for all errors) and customize this page for your users. Please, check out this example: https://knpuniversity.com/s... or look into the docs: https://symfony.com/doc/cur...

Cheers!

Hey Yahya E.
This may sound silly but did you add the correct use statement for Security annotation?

use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;

Cheers!

MolloKhan I double checked everything. It seemed fine. However, finally it turned out a bug in filesystem of Vagrant caused some missing files. I remove the dependencies then install again, It works now. Happy that we can ask you so we do not go forward onto darkside (giving up :)). Thanks.

NP! you are welcome, and I'm glad to hear that you could fix your problem :)

Hey Andjii,

This class was added in the previous episode Symfony Forms: Build, Render & Conquer! of "Starting in Symfony 3!" series. We started working with it at the beginning - check https://knpuniversity.com/s... .

Cheers!