New in Symfony 6.2: Security Improvements (Part 2)

Contributed by
Arnaud Frézet and Robin Chalas
in #41406.

use Symfony\Component\Security\Core\Security;
// ...

class SomeService
{
    public function __construct(
        private Security $security,
    ) {
    }

    public function someMethod()
    {
        // fetch a UserInterface object somehow (e.g. from a database)
        $user = ...

        // logout the user programmatically
        $this->security->logout($user);

        // use this optional argument if you prefer to not validate the
        // CSRF token according to the logout listener configuration
        $this->security->logout($user, validateCsrfToken: false);

        // ...
    }
}

Contributed by
Sébastien Alfaiate
in #46224.

$builder->add('plainPassword', PasswordType::class, [
    // the result of hashing the plaintext password will be stored in
    // a property called 'password' of the object passed to the form
    'hash_property_path' => 'password',

    // to minimize the risk of leaking the plaintext password, the
    // 'hash_property_path' option can only be used in unmapped properties
    'mapped' => false,
]);

Contributed by
Wouter de Jong
in #46580.

security:
   firewalls:
     main:
       logout:
-        csrf_token_generator: security.csrf.token_generator
+        enable_csrf: true

Contributed by
Hugo Alliaume
in #46066.

use Symfony\Bundle\SecurityBundle\Security\FirewallConfig;
use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\Security\Core\Security;
// ...

class SomeService
{
    public function __construct(
        private Security $security,
        private RequestStack $requestStack,
    ) {
    }

    public function someMethod()
    {
        $request = $this->requestStack->getCurrentRequest();
        /** @var FirewallConfig|null */
        $firewallConfig = $this->security->getFirewallConfig($request);

        $firewallName = $firewallConfig?->getName();

        // ...
    }
}