New in Symfony 6.2: Security Improvements (Part 1)

Simpler Programmatic Login

Contributed by
Arnaud Frézet and Robin Chalas
in #41274.

Logging in users programmatically is a common need in many applications. That's why in Symfony 6.2 we're adding a login() method to the Security service. On any service or controller, you can now do this:

use Symfony\Component\Security\Core\Security;
// ...

class SomeService
{
    public function __construct(
        private Security $security,
    ) {
    }

    public function someMethod()
    {
        // fetch a UserInterface object somehow (e.g. from a database)
        $user = ...

        // login the user programmatically
        $this->security->login($user);

        // if you have many authenticators associated to the current firewall,
        // you must pass explicitly the name of authenticator to use
        $this->security->login($user, 'form_login');
        $this->security->login($user, SomeApiKeyAuthenticator::class);

        // ...
    }
}

Custom Target URL When Impersonating Users

Contributed by
Antoine Makdessi
in #46338.

Similar to the feature that allows to configure the target URL after login, in Symfony 6.2 we're adding a new feature to allow you configure the target URL after impersonating a user. To do so, define the new target_url option under the switch_user option of your firewall:

# config/packages/security.yaml
security:
    # ...

    firewalls:
        main:
            # ...
            switch_user:
                # ...
                target_url: https://example.com/...

Contributed by
Mathias Brodala
in #46567.

When using login links to implement passwordless authentication, the lifetime of those links is configured globally for all. In Symfony 6.2 we're adding a feature so you can configure the lifetime per link. Use the third optional argument of createLoginLink() to override the global lifetime with a new custom value (in seconds):

// this login link will have a lifetime of 60 seconds
$loginLinkDetails = $loginLinkHandler->createLoginLink($user, null, 60);
$loginLink = $loginLinkDetails->getUrl();

Multiple User Checkers per Firewall

Contributed by
Michael Babker
in #46064.

User checkers allow you to define additional checks performed during the authentication of a user, to verify if the identified user is allowed to log in. You can only apply one user checker per firewall, which makes it harder to share logic.

Imagine an application that has two firewalls (e.g. API and traditional web login) and needs to apply these checkers: for both firewalls, check that the user account is not disabled; for the API firewall, check also that user has API access.

In Symfony 6.2 we're introducing a new "chained user checker" feature so you can call multiple user checkers for a firewall. To do so, apply to each user checker the tags corresponding to the firewall where it applies (tags follow the pattern security.user_checker.).

In Symfony 6.2, the previous example can be solved as follows:

namespace App\Security\User;

use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
use Symfony\Component\Security\Core\User\UserCheckerInterface;

#[Autoconfigure(tags: [['security.user_checker.main' => ['priority' => 10]]])]
#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 10]]])]
final class DisabledAccountUserChecker implements UserCheckerInterface
{
    // ...
}

#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 5]]])]
final class ApiAccessAllowedUserChecker implements UserCheckerInterface
{
    // ...
}
            <hr style="margin-bottom: 5px" />
            <div style="font-size: 90%">
                <a href="https://symfony.com/sponsor">Sponsor</a> the Symfony project.
            </div>

https://symfony.com/blog/new-in-symfony-6-2-security-improvements-part-1?utm_source=Symfony%20Blog%20Feed&utm_medium=feed

Created 3y | Nov 23, 2022, 5:20:06 PM


Login to add comment

Other posts in this group

Case study: A Long-Term Powerhouse Behind Vente-unique.com's E-Commerce Success (Zero Churn, All Wins!)

Vente-unique.com, a leading European online retailer of furniture and home decor, operates in 11 countries, powered by a team of 400 professionals and serving more than 3 million customers. From 15 ye

Jul 2, 2025, 9:10:03 AM | Symfony
A Week of Symfony #965 (June 23–29, 2025)

This week, Symfony 6.4.23, 7.2.8 and 7.3.1 maintenance versions were released. Meanwhile, the upcoming Symfony 7.4 version continued adding new features such as better controller helpers, more precisi

Jun 29, 2025, 9:10:15 AM | Symfony
Symfony 6.4.23 released

Symfony 6.4.23 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in you

Jun 28, 2025, 9:50:15 AM | Symfony
Symfony 7.2.8 released

Symfony 7.2.8 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your

Jun 28, 2025, 9:50:15 AM | Symfony
Symfony 7.3.1 released

Symfony 7.3.1 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your

Jun 28, 2025, 9:50:14 AM | Symfony
A Week of Symfony #964 (June 16–22, 2025)

This week, development activity was intense, with many bug fixes in the maintained branches, numerous deprecation removals in the 8.0 branch, and new features added to the 7.4 branch, including tighte

Jun 22, 2025, 8:10:05 AM | Symfony
SymfonyOnline June 2025: Speakers, Stats & Replays!

Thank you for joining us at SymfonyOnline June 2025!

What a great edition of SymfonyOnline we’ve just wrapped up! 🎉

We were thrilled to welcome 300 participants from 35 different countries—a

Jun 18, 2025, 8:50:17 AM | Symfony