symfony-security | 易学教程

How to programmatically login/authenticate a user?

阅读更多关于 How to programmatically login/authenticate a user?

问题 I'd like to log the user in right after the registration process, without passing by the login form. Is this possible ? I've found a solution with FOSUserBundle , but I'm not using it on the project I'm actually working on. Here is my security.yml, I'm working with two firewalls. The plain text encoder is just for testing. security: encoders: Symfony\Component\Security\Core\User\User: plaintext Ray\CentralBundle\Entity\Client: md5 role_hierarchy: ROLE_ADMIN: ROLE_USER ROLE_SUPER_ADMIN: [ROLE

Symfony Security logout not clearing RememberMe token

阅读更多关于 Symfony Security logout not clearing RememberMe token

问题 Using Symfony 4 with a security.yaml like this: encoders: App\Entity\User: sha256 providers: public_users: entity: class: App\Entity\User property: email firewalls: dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false main: pattern: ^/ anonymous: ~ form_login: login_path: login remember_me: true remember_me: secret: "%kernel.secret%" name: relevea_remember_me lifetime: 864000 always_remember_me: false remember_me_parameter: user_login[stayConnected] logout: path: logout target:

Symfony2 User not defined in Twig Exception Controller

阅读更多关于 Symfony2 User not defined in Twig Exception Controller

问题 I use my own action in order to handle exception in twig. # Twig Configuration twig: exception_controller: MyBundle:Default:showException The problem is that, i'm actually authenticated to my application, but in this special Controller the token is null. Does someone have any idea to solve this problem, cause I use the user object in the twig template. 回答1: From the docs: One of the common pitfalls when designing custom error pages is to use the is_granted() function in the error template (or

security.yml causes InvalidArgumentException: “You must at least add one authentication provider”

阅读更多关于 security.yml causes InvalidArgumentException: “You must at least add one authentication provider”

问题 I removed in-memory provider and DemoBundle, and added database provider, as per tutorial. But I'm getting InvalidArgumentException : "You must at least add one authentication provider" . My security.yml: # you can read more about security in the related section of the documentation # http://symfony.com/doc/current/book/security.html security: # http://symfony.com/doc/current/book/security.html#encoding-the-user-s-password encoders: AppBundle\Entity\User: algorithm: bcrypt # http://symfony

symfony2 call is_granted in voter : how to avoid an infinite loop?

阅读更多关于 symfony2 call is_granted in voter : how to avoid an infinite loop?

问题 I have built a voter where I need to invoke is_granted on a user. When injecting the security.authorization_checker service in my voter I get the following error ServiceCircularReferenceException in CheckCircularReferencesPass.php line 69: Circular reference detected for service "manager_voter", path: "manager_voter -> security.authorization_checker -> security.access.decision_manager -> manager_voter". Is there no alternative to injecting the whole container? Is this normal? EDIT: I am

Using one class Voter for many entities

阅读更多关于 Using one class Voter for many entities

问题 This is the function supportsClass in class Voter http://symfony.com/doc/2.5/cookbook/security/voters_data_permission.html public function supportsClass($class) { $supportedClass = 'AppBundle\Entity\Post'; return $supportedClass === $class || is_subclass_of($class, $supportedClass); } I'd like to know if it is possible to use one class voter for many entities in the same bundle or I have to create a Voter for each entity ? EDIT I have found this solution: public function supportsClass($class)

Symfony2 - Why voters are called even for SuperAdmins

阅读更多关于 Symfony2 - Why voters are called even for SuperAdmins

问题 I noticed that my voters are solicited even for SuperAdmin users. Is it working as expected ? If yes, I thought that the philosophy of SuperAdmin is that they systematically have all rights, so that we don't have to give them each permission one by one. In that case why not granting access to all voters ? Do I always have to put if ($user->isSuperAdmin()) { return VoterInterface::ACCESS_GRANTED; } in my voters ? 回答1: In the IddqdVoter class, you have a special role called ROLE_IDDQD . This

Passing object to custom voter?

阅读更多关于 Passing object to custom voter?

I've been reading up about creating custom voters in Symfony 2. According to this page , it is possible to pass an object to the isGranted method of the securitycontext, which I have done in my own controller: $page = new Page(); if ( ! $securityContext->isGranted('CONTENT_CREATE', $page)) { throw new AccessDeniedException('Fail'); } It looks like the vote method should be accepting it, however, when I call get_class on the $object parameter, instead of getting my Page entity, I get: Symfony\Component\HttpFoundation\Request public function vote(TokenInterface $token, $object, array $attributes

Using one class Voter for many entities

阅读更多关于 Using one class Voter for many entities

This is the function supportsClass in class Voter http://symfony.com/doc/2.5/cookbook/security/voters_data_permission.html public function supportsClass($class) { $supportedClass = 'AppBundle\Entity\Post'; return $supportedClass === $class || is_subclass_of($class, $supportedClass); } I'd like to know if it is possible to use one class voter for many entities in the same bundle or I have to create a Voter for each entity ? EDIT I have found this solution: public function supportsClass($class) { $classes = array( 'Project\AgenceBundle\Entity\Agence', 'Project\AgenceBundle\Entity\SubAgence',

Symfony2 - set security access_control to allow only authenticated anonymously

阅读更多关于 Symfony2 - set security access_control to allow only authenticated anonymously

Let's say I have my access_control block under the security.yml : access_control: - { path: ^/$, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/reset-password, roles: IS_AUTHENTICATED_ANONYMOUSLY } In this case everyone is alowed to enter homepage and reset-password pages. But I would like to allow these pages only for users authenticated anonymously. Fully authenticated users should get an 403 access denied error or 404 page not found . According documentation with allow_if I should be ablo to create role expressions to define access. But if I do it like this: access_control: - { path: ^