8000 Security: How to Build a Login Form: sync with recent Maker Bundle ch… · symfony/symfony-docs@f3d6674 · GitHub
[go: up one dir, main page]
Skip to content

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit f3d6674

Browse files
mhujermhujer
committed
Security: How to Build a Login Form: sync with recent Maker Bundle changes
1 parent 03105e0 commit f3d6674

File tree

1 file changed

+42
-17
lines changed

1 file changed

+42
-17
lines changed

‎security/form_login_setup.rst

Lines changed: 42 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -65,15 +65,24 @@ class that processes the login submit and 4) updates the main security config fi
6565
*/
6666
public function login(AuthenticationUtils $authenticationUtils): Response
6767
{
68+
// if ($this->getUser()) {
69+
// return $this->redirectToRoute('target_path');
70+
// }
71+
6872
// get the login error if there is one
6973
$error = $authenticationUtils->getLastAuthenticationError();
7074
// last username entered by the user
7175
$lastUsername = $authenticationUtils->getLastUsername();
7276

73-
return $this->render('security/login.html.twig', [
74-
'last_username' => $lastUsername,
75-
'error' => $error
76-
]);
77+
return $this->render('security/login.html.twig', ['last_username' => $lastUsername, 'error' => $error]);
78+
}
79+
80+
/**
81+
* @Route("/logout", name="app_logout")
82+
*/
83+
public function logout()
84+
{
85+
throw new \Exception('This method can be blank - it will be intercepted by the logout key on your firewall');
7786
}
7887
}
7988

@@ -137,11 +146,17 @@ a traditional HTML form that submits to ``/login``:
137146
<div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>
138147
{% endif %}
139148

149+
{% if app.user %}
150+
<div class="mb-3">
151+
You are logged in as {{ app.user.username }}, <a href="{{ path('app_logout') }}">Logout</a>
152+
</div>
153+
{% endif %}
154+
140155
<h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
141-
<label for="inputEmail" class="sr-only">Email</label>
142-
<input type="email" value="{{ last_username }}" name="email" id="inputEmail" class="form-control" placeholder="Email" required autofocus>
143-
<label for="inputPassword" class="sr-only">Password</label>
144-
<input type="password" name="password" id="inputPassword" class="form-control" placeholder="Password" required>
156+
<label for="inputEmail">Email</label>
157+
<input type="email" value="{{ last_username }}" name="email" id="inputEmail" class="form-control" required autofocus>
158+
<label for="inputPassword">Password</label>
159+
<input type="password" name="password" id="inputPassword" class="form-control" required>
145160

146161
<input type="hidden" name="_csrf_token"
147162
value="{{ csrf_token('authenticate') }}"
@@ -171,10 +186,9 @@ a traditional HTML form that submits to ``/login``:
171186

172187
use App\Entity\User;
173188
use Doctrine\ORM\EntityManagerInterface;
174-
175189
use Symfony\Component\HttpFoundation\RedirectResponse;
176190
use Symfony\Component\HttpFoundation\Request;
177-
use Symfony\Component\Routing\RouterInterface;
191+
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
178192
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
179193
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
180194
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
@@ -185,21 +199,22 @@ a traditional HTML form that submits to ``/login``:
185199
use Symfony\Component\Security\Csrf\CsrfToken;
186200
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
187201
use Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator;
202+
use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
188203
use Symfony\Component\Security\Http\Util\TargetPathTrait;
189204

190-
class LoginFormAuthenticator extends AbstractFormLoginAuthenticator
205+
class LoginFormAuthenticator extends AbstractFormLoginAuthenticator implements PasswordAuthenticatedInterface
191206
{
192207
use TargetPathTrait;
193208

194209
private $entityManager;
195-
private $router;
210+
private $urlGenerator;
196211
private $csrfTokenManager;
197212
private $passwordEncoder;
198213

199-
public function __construct(EntityManagerInterface $entityManager, RouterInterface $router, CsrfTokenManagerInterface $csrfTokenManager, UserPasswordEncoderInterface $passwordEncoder)
214+
public function __construct(EntityManagerInterface $entityManager, UrlGeneratorInterface $urlGenerator, CsrfTokenManagerInterface $csrfTokenManager, UserPasswordEncoderInterface $passwordEncoder)
200215
{
201216
$this->entityManager = $entityManager;
202-
$this->router = $router;
217+
$this->urlGenerator = $urlGenerator;
203218
$this->csrfTokenManager = $csrfTokenManager;
204219
$this->passwordEncoder = $passwordEncoder;
205220
}
@@ -247,23 +262,31 @@ a traditional HTML form that submits to ``/login``:
247262
return $this->passwordEncoder->isPasswordValid($user, $credentials['password']);
248263
}
249264

265+
/**
266+
* Used to upgrade (rehash) the user's password automatically over time.
267+
*/
268+
public function getPassword($credentials): ?string
269+
{
270+
return $credentials['password'];
271+
}
272+
250273
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
251274
{
252275
if ($targetPath = $this->getTargetPath($request->getSession(), $providerKey)) {
253276
return new RedirectResponse($targetPath);
254277
}
255278

256-
// For example : return new RedirectResponse($this->router->generate('some_route'));
279+
// For example : return new RedirectResponse($this->urlGenerator->generate('some_route'));
257280
throw new \Exception('TODO: provide a valid redirect inside '.__FILE__);
258281
}
259282

260283
protected function getLoginUrl()
261284
{
262-
return $this->router->generate('app_login');
285+
return $this->urlGenerator->generate('app_login');
263286
}
264287
}
265288

266-
**Step 4.** Updates the main security config file to enable the Guard authenticator:
289+
**Step 4.** Updates the main security config file to enable the Guard authenticator and configure logout route:
267290

268291
.. configuration-block::
269292

@@ -279,6 +302,8 @@ a traditional HTML form that submits to ``/login``:
279302
guard:
280303
authenticators:
281304
- App\Security\LoginFormAuthenticator
305+
logout:
306+
path: app_logout
282307
283308
.. code-block:: xml
284309

0 commit comments

Comments
 (0)
0