Logging out & Pre-filling the Email on Failure

Yo Yang!

Make sure you have the use statement for the Security class at the top of your file - it should be:

use Symfony\Component\Security\Core\Security;

I'm going to update our code blocks on this page - it wasn't highlighting that this was needed :).

Cheers!

ok, that solved the problem. Found out that when I autocompleted Security, I accidently added the use statement
Sensio\Bundle\FrameworkExtraBundle\Configuration\Security
thx

Cheers! :)

Hey Imogen,

Hm, are you sure the $data['_username'] doesn't empty when you set it into session? Could you make sure with dump($data['_username']); before setting it? Also ensure you print the last username in Twig template of your login form.

AFAIK, since Symfony 2.6 a new security error helper was added - check the example how to use it: http://symfony.com/blog/new-in-symfony-2-6-security-component-improvements#added-a-security-error-helper

Does it help you?

Cheers!

Hi...

If I do either of these

$data = $form->getData();
$request->getSession()->set(
Security::LAST_USERNAME,
$data['_username']
);

dump($data['_username']); die;
return $data;

OR

$data = $form->getData();
$request->getSession()->set(
Security::LAST_USERNAME,
$data['_username']
);

dump($request->getSession()->get(
Security::LAST_USERNAME
));die;
return $data;

I get the username dumped to the screen... No idea how to debug beyond this... Any help would be much appreciated. Thank you.

FYI, Found the problem - simple type in SecurityController. Thank you for comments.

$form = $this->createForm(LoginForm::class,[
'username' => $lastUsername,
]);

SHOULD BE

$form = $this->createForm(LoginForm::class,[
'_username' => $lastUsername,
]);

NOTE '_username' NOT 'username'

Good catch! Glad you got it working.

Cheers!

Hey, Matthew!

Yes, you're right, it's not ready yet. But it will be very soon!

Hey there!

New videos are added!

Hey Adam!

Sorry for the late response, for some reason this message went directly to the spam folder =S

At the beginning it migh look's like magic, but it's not, all that `AuthenticationUtils::getLastUsername()` does, is fetch a value from the session, in this case it's empty because Symfony doesn't know how to fill it, thats why we manually set it with the value of the username input. Maybe if you rewatch the very first and half minute you will get it.

Cheers!

Hey Terry!

It's an interesting question, and actually, yes, you can!
You just have to write the route's name instead of the path e.g.

//security.yml
logout:
    path: logout_name

Of course, if you have to change the route's name, well you need to change it in here too, but that's less likely to happen.

Have a nice day!

Hey Terry Caliendo

You can specify to which path you want to redirect them by setting up the target key in your security.yml, by default it's set to "/"

security:
    firewalls:
        main:
             logout:
                  target: /your/custom/path

But, if you want something more dynamic, you will have to create your own "LogoutHandlerListener", it's almost a regular listener but it has to implement "LogoutHandlerInterface", you can follow what this guy did here: http://stackoverflow.com/a/39293401

Have a nice day!

Thanks for the response and the reference.

I had previously overlooked this page, but I also now see the key in here.
http://symfony.com/doc/curr...

Thanks again!
Terry

NP man, it has been fun replying to your questions :)

Cheers!

Hey Yang,

Use global app variable to access user object, i.e. {{ app.user.username }}. But ensure your user is authenticated, otherwise you'll get an error:

{% if is_granted('IS_AUTHENTICATED_ANONYMOUSLY') %}
     <li>Login...</li>
{% else %}
    <li>< a href="{{ path('security_logout') }}">Logout</li>
{% endif %}

Cheers!

Hey Jovana Gajic

How are you checking that you are logged in, in your template?
Can you check at your profiler bar if it says "anon." after logging in?

Cheers!

if I type this {% if is_granted('ROLE_USER') %} it redirects me back to the login page. If I omit this part, I get logged in, and profile bar shows my username. When I'm redirected to login page it shows anon in profile bar

Ohh, this is interesting. I believe the is_granted() function is doing something nasty. Can you tell me which version of Symfony are you using?

Try changing your if statement to this:

{% app.user and is_granted('ROLE_USER') %}

And let me know if it works ;)

Hey, I've finally made some progress. I figured out that I was logged in but wasn't authenticated. At one moment I've made my model implement the Serializable, as described in Symfony documentation, and once I removed it, along with the serialize and the unserialize methods it worked. I suppose those methods for serializing, unserializing weren't good for this case

Hey Jovana,

If you were logged in but were not authenticated - probably you have some misconfiguration of your firewall. If you still have a problem, could you show us your "security.firewalls" section in app/config/security.yml ? Or also there could be a problem in your serialize()/unserialize() methods implementations, probably you unserialize incorrectly (incorrect fields order, etc.), but it's difficult to say without seeing your implementation of those methods.

Cheers!

Hey Yang,

It's easy enough! You have access to the global context in Twig templates which allows to get currently logged in user with app.user. So just use:

<li>
  {% if app.user %}
    &lt;a href="{{ path('security_logout') }}&gt;Logout&lt;/a&gt;
  {% else %}
    &lt;a href="{{ path('security_login') }}&gt;Login&lt;/a&gt;
  {% endif%}
</li>

Cheers!

that was fast!! good to know, thx, I modify the original code and added {{ app.user.username }}, it works nicely. thx

Be careful! You can failed with error when user IS null if you just checking app.user.username Use extra check in if statement like:
{% if app.user and app.user.username %}

But probably if app.user will be enough here, because for some weird reasons user could have no username but could be logged in. I mean, that app.user return an object <i>only</i> if a user is logged in. So you don't need username extra check here.

Cheers!

I think theres a small missunderstanding here, I want to output the username, not to check. because the original <li> codes are wrapped in a if-block already {% if is_granted('ROLE_USER') %}. I thought users only get a role if they are logged in, so this already check if user is logged in. So if it's true, I can output the username by simplying adding {{app.user.username }} in front of the logout-button.

Ah, then it makes sense! Yes, you're definitely right here! :)

Hey Julia Shishik!

I can definitely help :). So if you're seeing nothing - like no errors in any situation - then it's possible that your authenticator is not being called at all! Here's what you can do to check. First, put var_dump('here!');die; at the top of your getCredentials() method. Is this being called? If not, check your services.yml and security.yml setup. If you configure your authenticator correctly, the getCredentials() method should be called on every request. If the method IS being called, check your logic in getCredentials() to make sure you're checking the current URL correctly. Also, verify that getUser() is being called when you submit. If getUser() is called, then, at the very least, you should definitely see an error message when you type in a wrong user/pass. So, the problem is probably somewhere before this.

Let me know what you find out!

Cheers!

Good morning!
getCredentials() method is being called.

getUser() is NOT called((
Logged in asanon.
AuthenticatedYes
Token classAnonymousToken
Firewall namemain

and 2 missing translation, and log message

INFO
21:51:37
request Matched route "security_login".
Show context
INFO
21:51:37
security Populated the TokenStorage with an anonymous Token.
WARNING
21:51:37
translation Translation not found.
Show context
WARNING
21:51:37
translation Translation not found.
Show context
Last 10

Hey Julia,

Good investigation! getCredentials() called on every request and your job is to read the credentials from the request and return it. If you return null, the rest of the authentication process is skipped, i.e. getUser() won't be called. Otherwise, getUser() will be called and the return value is passed as the first argument.

So make sure you *return* credentials in getCredentials() method.

Cheers!

Oh, thank you very much! Yes, I had an error in the method getCredentials. I missed the exclamation mark befor $isLoginSubmit! Oh yeah. It is sad! But now everything is fine

Hey Mehdi,

Good questions! There're a few possible solutions:

1. Just add one more extra check in the beginning of loginAction(), and if user is logged in - redirect him to homepage.

if ($this->getUser()) {

return $this->redirectToRoute('homepage');

}

Probably this one is the best.

2. Or, add if statement in your loginAction() and if user is logged in - *render* homepage, if not - render login page. But in this case you will show home page under the "/login" URL which is a bit weird, so I'd prefer the 1st solution :)

Cheers!

Hello,
I am sorry for the late reply.
I used the first solution and it worked for me.
Thank you Victor

Hey Mehdi,

No problem! I'm glad you got it working for you ;)

Cheers!

Hey Markus B.
One way of achieving it is via an "Access control list", you can configure your own inside the security.yml file
You can find more detailed information here: https://symfony.com/doc/current/security/access_control.html
This is a basic example of securing all pages but login

    access_control:
        - { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY  }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY }

Have a nice day :)

Hey Moudug!

Hmm. So it's not exactly what you're saying :). Actually, when you hit back, you are still logged out - but your browser is showing your the previous page, as it looked when you were there a moment ago. If you try to click on any links that require login, you'll go to the login page (because you're not actually logged in).

If you google the issue, there are some solutions - but it's just not something that's super well supported. One decent solution might be to run some JavaScript on an interval (e.g. every 30 seconds + on page load). In that JS, make an AJAX call to your server to see if the user is logged in. If they are not, redirect to the login page. Then, even if the user has 10 browser tabs open, if you logout in one of them, the other tabs will go to the login page after a few seconds.

Cheers!