New in Symfony 5.3: Improvements for Security Users

Renamed User to InMemoryUser¶

        Contributed by 
        Robin Chalas 
        in #40443.

In Symfony applications, the memory user provider allows to create users (and define their credentials) in a configuration file which is loaded in memory, without using databases or any other persisting service. Although this user provider is only for prototypes or very small/special applications, it’s based on a class called User (the entire namespace is Symfony\Component\Security\Core\User\User). This confuses some newcomers, who think this is the main User class in Symfony security. That’s why in Symfony 5.3 we’ve renamed User to InMemoryUser and UserChecker to InMemoryUserChecker to better convey their purpose (in 5.3 the old names still work but they are deprecated and in Symfony 6.0 they will be removed): 1 2 3 4 5 # config/packages/security.yaml security: password_hashers:

  • Symfony\Component\Security\Core\User\User: bcrypt
  • Symfony\Component\Security\Core\User\InMemoryUser: bcrypt Renamed username to identifier¶

        Contributed by 
        Wouter De Jong
         in #40403.

Another source of confusion related to users is the concept of “username” which is used in the Symfony security. In many applications this username is not a traditional username, but an email or even some API token. That’s why in Symfony 5.3 we’ve decided to avoid this confusion and we’ve renamed “username” to “user identifier”. This might require some changes in your application code (in 5.3 the old names still work but they are deprecated and in Symfony 6.0 they will be removed): UserInterface::getUsername() is now UserInterface::getUserIdentifier() loadUserByUsername() is now loadUserByUserIdentifier(), both in user loaders and user providers UsernameNotFoundException is now UserNotFoundException Decoupled Passwords from Users¶

        Contributed by 
        Robin Chalas 
        in #40267.

The Symfony\Component\Security\Core\User\UserInterface is implemented by all the security users in Symfony applications. Sadly, this interface is a product of its time and it contains some methods that are no longer used in modern applications. The first unneeded method is getSalt(), which is no longer necessary when using modern password hashing algorithms (bcrypt, Argon2, etc.) This method has been moved to a new LegacyPasswordAuthenticatedUserInterface. The other method is getPassword() which is no longer needed in many password-less features, such as login links. This method has been moved to a new PasswordAuthenticatedUserInterface. In Symfony 5.3, UserInterface implements these two interfaces, so you don’t need to change anything in your code. In Symfony 6.0 that will be no longer the case and you’ll need to implement the new interfaces if you need those methods.

                Sponsor the Symfony project.

http://feedproxy.google.com/~r/symfony/blog/~3/rVtcrgKL4Mg/new-in-symfony-5-3-improvements-for-security-users

Létrehozva 4y | 2021. máj. 3. 7:20:06


Jelentkezéshez jelentkezzen be

EGYÉB POSTS Ebben a csoportban

Case study: A Long-Term Powerhouse Behind Vente-unique.com's E-Commerce Success (Zero Churn, All Wins!)

Vente-unique.com, a leading European online retailer of furniture and home decor, operates in 11 countries, powered by a team of 400 professionals and serving more than 3 million customers. From 15 ye

2025. júl. 2. 9:10:03 | Symfony
A Week of Symfony #965 (June 23–29, 2025)

This week, Symfony 6.4.23, 7.2.8 and 7.3.1 maintenance versions were released. Meanwhile, the upcoming Symfony 7.4 version continued adding new features such as better controller helpers, more precisi

2025. jún. 29. 9:10:15 | Symfony
Symfony 6.4.23 released

Symfony 6.4.23 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in you

2025. jún. 28. 9:50:15 | Symfony
Symfony 7.2.8 released

Symfony 7.2.8 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your

2025. jún. 28. 9:50:15 | Symfony
Symfony 7.3.1 released

Symfony 7.3.1 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your

2025. jún. 28. 9:50:14 | Symfony
A Week of Symfony #964 (June 16–22, 2025)

This week, development activity was intense, with many bug fixes in the maintained branches, numerous deprecation removals in the 8.0 branch, and new features added to the 7.4 branch, including tighte

2025. jún. 22. 8:10:05 | Symfony
SymfonyOnline June 2025: Speakers, Stats & Replays!

Thank you for joining us at SymfonyOnline June 2025!

What a great edition of SymfonyOnline we’ve just wrapped up! 🎉

We were thrilled to welcome 300 participants from 35 different countries—a

2025. jún. 18. 8:50:17 | Symfony