New in Symfony 6.2: Security Improvements (Part 1)

Contributed by
Arnaud Frézet and Robin Chalas
in #41274.

use Symfony\Component\Security\Core\Security;
// ...

class SomeService
{
    public function __construct(
        private Security $security,
    ) {
    }

    public function someMethod()
    {
        // fetch a UserInterface object somehow (e.g. from a database)
        $user = ...

        // login the user programmatically
        $this->security->login($user);

        // if you have many authenticators associated to the current firewall,
        // you must pass explicitly the name of authenticator to use
        $this->security->login($user, 'form_login');
        $this->security->login($user, SomeApiKeyAuthenticator::class);

        // ...
    }
}

Contributed by
Antoine Makdessi
in #46338.

# config/packages/security.yaml
security:
    # ...

    firewalls:
        main:
            # ...
            switch_user:
                # ...
                target_url: https://example.com/...

Contributed by
Mathias Brodala
in #46567.

// this login link will have a lifetime of 60 seconds
$loginLinkDetails = $loginLinkHandler->createLoginLink($user, null, 60);
$loginLink = $loginLinkDetails->getUrl();

Contributed by
Michael Babker
in #46064.

namespace App\Security\User;

use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
use Symfony\Component\Security\Core\User\UserCheckerInterface;

#[Autoconfigure(tags: [['security.user_checker.main' => ['priority' => 10]]])]
#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 10]]])]
final class DisabledAccountUserChecker implements UserCheckerInterface
{
    // ...
}

#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 5]]])]
final class ApiAccessAllowedUserChecker implements UserCheckerInterface
{
    // ...
}