HTML5 & "Sanity" Validation

Hey denizgelion!

Excellent question! So here's what happened / how this works in Symfony:

A) At some point, Symfony decided to make the getUser() method "final" (so that you can't extend it). Symfony does this kind of thing to keep the "hook points" in Symfony intentional. Basically, they're telling us "Hey! If you need to customize the getUser() method in some way, you should do it some other way than extending it". But instead of just adding the final keyword on the function (which would break our code), they add this warning. This warns you that someday they may add the final keyword (which would break our code) so you should stop using it.

B) In our case, we did it just so we could add the @return User with our User class so that PHPStorm would be happy. So then, how can we do this without overriding getUser()? You can do this by removing our custom getUser() method entirely in BaseController, and instead doing this:

// ....
use App\Entity\User;
// ...

/**
 * @method User getUser()
 */
class BaseController extends AbstractController
{
}

That will have the same effect, but no deprecation. By the way, about this:

And why "without further notice"? Are these changes not going to be listed in a patch list of some sort

That's not really true :). If Symfony decided to add the final keyword, it would only ever do it on a major release - like Symfony 5.0.0, 6.0.0, etc. It would ever be done, for example, between 4.4.5 and 4.4.6 (a patch release or a minor release).

Cheers!

Thanks a bunch for the quick reply, I appreciate it alot! Keep up the good work, I've seen plenty tutorials in my life, and eventough you keep using those corny jokes, I can't help myself but love it.

Hey Eugem!

If you're using the form system for the login form, then the "sanity validation" (the validation that's automatically built-in to the form field types [just repeating that to help others]) should happen automatically. Well, what I mean is, in your login authenticator, just make sure to handle your form like normal - $form->handleRequest(). That will run normal validation and sanity validation. If any sanity validation fails, $form->isValid() will return false. You shouldn't need to do anything special to get sanity validation.

Let me know if that helps! And sorry for the slow reply - we were missing notifications from our comment system for a few days!

Cheers!

$form->isValid() will return false. And after that the form got rendered with with errors 'This is not valid email'. And all of this happen at LoginFormAuthenticator object inside getCredentials() method. After that SecurityController creates new form and previous 'rendered with with errors form' is lost. How can I got this errors from login form? Errors like This is not valid email' or 'password is too short'

Hey Eugem

Since the login action is a bit different from any other form submit, you have to fetch the errors by using a special Symfony service AuthenticationUtils. You can watch how Ryan does it by following this chapter: https://symfonycasts.com/screencast/symfony-security/auth-errors

Cheers!

Hey Kim W.!

You're right! But we install the symfony/validator in the middle of this chapter - so it should be available after that :). But, you do bring up a good point. Until about a week ago, "sanity validation" wasn't applied at *all* unless symfony/validator was installed. But, thanks to this fix - https://github.com/symfony/... - any newer versions will always apply sanity validation... but you can't control the message with this option unless symfony/validator is installed.

Cheers!