Symfony Security: Beautiful Authentication, Powerful Authorization

I agree! I'm finishing the React tutorial this week - then straight to security! Weeeee!!!!

Hey, wrote a letter on your mail (through Contact Us section), still no answer (sir.****@y*.**)

Hey Vadim,

We're sorry, it were weekends. Just answered both your emails. Thank you for your patience!

Cheers!

Yes when will this one be completed?

Hey Jimmy,

We completely released ReactJS tutorial finally, but now we have an intermediate small one - Contributing to Symfony: https://knpuniversity.com/s... . So the next should be this one. Thank you for your patience!

Cheers!

I see that there are still react tutorial published, is there a new ETA? Cant wait to see this new high quality tutorial from you Ryan!

Hey Mike!

Here's our upcoming tutorials list: https://knpuniversity.com/c... - as you can see this one should be next for now. We need about 2-3 weeks to completely release ReactJS course, and, in the best case, I think this tutorial will be started releasing in a month. But that's just a wild guess for now, we'll have more precise dates after ReactJS. Thank you for your patience!

Cheers!

Hey Arek,

We're going to start releasing ReactJS tutorial this week, and then this one will be next I think. Thanks for your patience.

You can track upcoming screencasts on this page: https://knpuniversity.com/c...

Cheers!

Hey @jmartins

We do have a newer version of this tutorial. However, it's built on Symfony 5, but that's not important because the Symfony Security component has not changed significantly since then.
https://symfonycasts.com/screencast/symfony-security

Cheers!

Hey Ruslan

In Symfony 5.1 they introduced a new security system, which is just simpler than the current one, so, if you already understand how this "old" security system works, you'll understand pretty quickly how the new one works. I leave you here a blog related to it https://symfony.com/blog/ne...

About the ApiPlatform security, well, that tutorial is focused on how to enable/add security to your API built with ApiPlatform, although it uses Symfony security under the hood.

Cheers!

Hi MolloKhan ,
Thank you for clarification.
Today many people use php (and Synfony) for back ground only. But I prefer to use total MVC and too :) .
Twig and related security settings,commands interesting for me.

That's nice, I believe you may enjoy watching our tutorial about Symfony Messenger https://symfonycasts.com/sc...

Cheers!

hey Wuwu,

Look at Lulu tip here: https://symfonycasts.com/sc... - you don't want to extract that raw info from the session, better use "app" global Twig var that gives you access to the current user and other useful objects like request, etc.

Cheers!

Dear wuwu,

you can use twig global object User as {{ app.user.firstname }}

Hey Lulu,

Thank for this tip!

Cheers!

Hey be_tnt

What you could do is to put all the bundle files in a non-accessible web directory (in other words, out of the public directory in Symfony), and then, code a controller's action (an endpoint), so it can check if there is a logged in user before serving any files. It's like a proxy, you first have to hit "some" route in order to access a file

Cheers!

Thx MolloKhan .

I have also thought about this solution but the issue for me is how to "redirect" to the entry point of the bundle? Most of my controllers render a twig template or return a JsonResponse for ajax request. How to return an html file?

Thx!

Ah ok, I understand. It depends on what you want to do. Do you want to download the file, show it as plain text, or render it?

render it :) it's an e-learning application done with html, javascript, css and video files.

Have you tried to render it as you would do with any other template? I think it should just work if you render it with Twig, unless it contains PHP code inside it

yep but it did not work due to the urls included in this html files (even if all the files were in the same directory).

Ex: the. starting html file contains :

<script src="story_content/user.js" type="text/javascript"></script>

This can not be found as symfony will look into the public folder to find this file.

Ohh, that's a problem indeed. The assets that your files depend on have to live in a public directory because they will be downloaded by the user's browser (unless you inline all the content in a single file). You may want to move all those assets to a public folder so they can be accessible

Hey Jose carlos C.

So, you want to inform the user that his session has expired due to non-activity? Or what you mean by "When a session ends"?

Cheers!

Hey MolloKhan , when it has expired.

Ah I get it. What I've seen other sites doing is that they ping the server every minute (or maybe less) via javascript. So, they can know if the session already ended and if so, you execute your logic. Does it makes any sense to you?

I'm sorry for the delay, it was what I was planning to do, but I asked if there was any way less hard, but well you have already confirmed it to me, so I will do it that way. Thank so much

Hey Khaled A.

I recommend you to use this bundle https://github.com/hwi/HWIO...

Cheers!

Yo Skylar !

Nothing exists like that currently - it's actually really cool idea though, however security rules are added in some many ways, it's hard to make a solution that would work for everyone. I have seen a company do this in the past who used security annotations for everything - they wrote their own console command. It's actually a bit easier than you may think, it involves:

1) Iterating over all of your controller classes (I would probably use Finder to find all files in my Controller directory, then do a little string "playing" to convert that into class names)

2) Inside the loop, use PHP Reflection (http://php.net/manual/en/reflectionclass.getmethods.php) to get all the methods.

3) For each method, it it is public (if it's not public, just "continue"), use the annotations reader (autowireable by type-hinting the argument with Doctrine\Common\Annotations\Reader) and call getMethodAnnotations() to read the annotations off of that method. This will return all of the annotations, including @Route and @IsGranted. You can use this information to figure out which endpoints use which security config.

This really requires very consistent use of annotations for security to work - if you have a bunch of security applied inside the function itself (e.g. `$this->denyAccessUnlessGranted()</code), that's pretty impossible for a command to "parse" and understand.

Let me know if that helps or gives you some ideas!

Cheers!

Hey Waldemar Dell!

Yes, in this tutorial, we do all authentication via Guard. The SimplePreAuthenticatorInterface was deprecate in Symfony 4.2 because it basically does the same thing as Guard, but Guard is a bit easier to use.

Cheers!

Thank you very much. That's the answera I needed.Wow, I got an answer from Ryan, I feel so good. Love your Tutorials. I watched nearly everything about symfony 3.3. IT was great.

Hey Justin!

Actually, you nailed it - nice work! Ok, back story: Symfony doesn’t natively handle two factor auth. It’s not that it can’t - but no official solution has been set forward. I’ve never had to implement it, but I’ve been telling people for years to do exactly what you’re proposing. Let me see if I can fill in a few of the fuzzy pieces:

1) in the first authenticator, once you determine that authentican is successful (you found their User), you cannot return the User from getUser(). That would cause auth to be successful, which is actually not what you want. You’ll need to create a custom Exception class and make it implement Synfony’s AuthenticationException. Add a User argument to the constructor, store the user on a property, and add a getUser() method to the exception class. Then, at the bottom of getUser(), instead of returning the user, throw now NowReadyForSecondStepAuthException($user) - or whatever you call it.

2) this will cause onAuthenticationException() to be thrown. If you see a different exception, handle it like normal. But if you see this exception, store the user I’d in the session and redirect to whatever URL will hold your second step of auth.

3) make your second authenticator only return true in supports() if the user is on the correct URL and if that session key exists. Do whatever you need to do here - it’s kind of a normal authenticator, except that it’s checking for and using that value in the session.

4) and that’s it! You kinda don’t need to prevent the user from navigating away from the 2nd factor auth, because with this method, they are not authenticated at all until they complete step 2. If they navigate away, good for them - they are anonymous still.

So, you can see that it’s kinda straightforward, but the details are tricky. There are people that definitely want to make this easier.

Let’s me know what questions you have - happy to help!

Cheers!

Awesome! It works perfectly! Quick note to anyone else trying this, the method is onAuthenticationFailure() not onAuthenticationException().

Once I got this working (yay) I realized maybe I didn't fully think through the UX (boo). I would like to try again, this time using AJAX to submit the login form. Basically, show the username/password, submit via AJAX, if the user needs 2FA pass back some JSON indicating the 2FA code is needed, show the 2FA field, submit the login again, this time with all three fields populated. This would also be nicer as it only needs one authenticator. I'm guessing a POST request to the same path would work but I would need to somehow return JSON on failure.

Essentially, the only part I'm unsure about is how, if submitting a form via AJAX, are form/field errors handled? Ideally I would keep the functionality of "wrong username or password" for the initial two fields, but then add some "wrong 2fa code" as necessary. Is there some JS form magic for working with forms/returned errors via AJAX?

Thank you again for the incredible tutorials and assistance!

Hey Justin V.!

Woohoo! Thanks for the update that it worked :).

I would like to try again, this time using AJAX to submit the login form. Basically, show the username/password, submit via AJAX, if the user needs 2FA pass back some JSON indicating the 2FA code is needed, show the 2FA field, submit the login again, this time with all three fields populated.

Yes, except I would only submit the 2FA code the second time - not the also the email & password again. It's just not necessary (you can set something on the session that they have passed this first "step") and it could get weird because you'll need to keep the email & password fields somewhere on the DOM so you can re-submit those values. Basically, you CAN do what you're saying, just be aware that you will have the password "floating around" the client side a bit longer. But yea, you could use 1 or 2 authenticators really, no matter what you do. It's just a matter of code organization - so do what feels best.

Essentially, the only part I'm unsure about is how, if submitting a form via AJAX, are form/field errors handled

By default, if you're extending the AbstractFormLoginAuthenticator, the onAuthenticationException method stores the validation error to the session and redirects you. I think you're already not relying on this, as you've overridden this method. So basically, you would just need to grab the exception error from the AuthenticationException and put it in the JSON you want to return - you can see what the base class does here: https://github.com/symfony/symfony/blob/1ad6f6f31923dcbca19a6a25a191e93d68bb1a4d/src/Symfony/Component/Security/Guard/Authenticator/AbstractFormLoginAuthenticator.php#L39-L48 - what you actually need is $exception->getMessageKey() - that is the string that contains "what went wrong during authentication". Return that in the JSON, then it will be your responsibility to render that onto your form somehow via JavaScript.

Let me know if that makes sense! Sounds like the feature will be awesome.

Cheers!

Ryan, is this still available solution also for symfony 5? or there exists a native solution for two factor auth?
Thank you!

Hey Daniel!

Excellent question! today I would use: https://github.com/scheb/2fa - it's VERY high quality :).

Cheers!

Hi Ryan,
Thank you for reply and the proposal, but I would like to try the option proposed by you above in order to learn new things, but I have a doubt about the following statement:

<blockquote>. Add a User argument to the constructor, store the user on a property, and add a getUser() method to the exception class. Then, at the bottom of getUser(), instead of returning the user, throw now NowReadyForSecondStepAuthException($user) - or whatever you call it.</blockquote>

The "NowReadyForSecondStepAuthException" is the name of the exception class itself?
I took the following approch:

class NowReadyForSecondStepAuthException extends AuthenticationException
{
    /**
     * @var UserRepository
     */
    private $user;

    public function __construct(UserRepository $user)
    {
        $this->user = $user;
    }

    /**
     * Get the user.
     *
     * @return string
     */
    public function getUser()
    {
        throw new NowReadyForSecondStepAuthException($this->user);
    }

    /**
     * {@inheritdoc}
     */
    public function getMessageData()
    {
        return ['{{ username }}' => $this->user];
    }

}

And from the first authenticator, from getUser method I called:

// $this->authenticatorException - object of NowReadyForSecondStepAuthException class
return $this->authenticatorException->getUser();```



Do I understand well?