Skip to content

Commit 76a6c65

Browse files
weaverryanweaverryan
committed
feature #10423 [Security] Huge Overhaul of all security (weaverryan)
This PR was squashed before being merged into the 4.1 branch (closes #10423). Discussion ---------- [Security] Huge Overhaul of all security Hi guys! I would *warmly* appreciate review, though, I realize that this is another *huge* PR. Apologies - but the security section really needed it. Here are some important notes: * I've made the changes to 4.1, following in a newer policy we've been adopting to only apply changes (with the exception of strict bug fixes) to the current-released branch or higher. * This uses some new features from the upcoming release of MakerBundle. Specifically `make:user` and the enhanced `make:auth` that is capable of generating the entire login form setup. These have simplified & shortened parts of the docs. * I've made Guard the preferred authentication mechanism. We show it first... and then mention the other, built-in providers, like `form_login`, etc. * The `simple_preauth` and `simple_form` are not currently documented at all after this change. I believe we should discuss deprecating them. Cheers! Commits ------- ed3dd65 removing old reference 7d01771 Fixing missing link 3e63a6c Tweaks based on feedback 0c8d7c0 Many changes thanks for GREAT feedback from various people 066794f Overhauling the security section
2 parents bece514 + ed3dd65 commit 76a6c65

36 files changed

+1647
-3581
lines changed

‎_build/redirection_map

+8
Original file line numberDiff line numberDiff line change
@@ -390,3 +390,11 @@
390390
/quick_tour/the_view /quick_tour/flex_recipes
391391
/service_container/service_locators /service_container/service_subscribers_locators
392392
/templating/overriding /bundles/override
393+
/security/custom_provider /security/user_provider
394+
/security/multiple_user_providers /security/user_provider
395+
/security/custom_password_authenticator /security/guard_authentication
396+
/security/api_key_authentication /security/api_key_authentication
397+
/security/pre_authenticated /security/auth_providers
398+
/security/host_restriction /security/firewall_restriction
399+
/security/acl_advanced /security/acl
400+
/security/password_encoding /security

‎_images/security/http_basic_popup.png

-38.6 KB
Binary file not shown.

‎_images/security/symfony_loggedin_wdt.png

61 KB
Loading

‎best_practices/security.rst

-20
Original file line numberDiff line numberDiff line change
@@ -376,26 +376,6 @@ via the even easier shortcut in a controller::
376376
// ...
377377
}
378378

379-
Learn More
380-
----------
381-
382-
The `FOSUserBundle`_, developed by the Symfony community, adds support for a
383-
database-backed user system in Symfony. It also handles common tasks like
384-
user registration and forgotten password functionality.
385-
386-
Enable the :doc:`Remember Me feature </security/remember_me>` to
387-
allow your users to stay logged in for a long period of time.
388-
389-
When providing customer support, sometimes it's necessary to access the application
390-
as some *other* user so that you can reproduce the problem. Symfony provides
391-
the ability to :doc:`impersonate users </security/impersonating_user>`.
392-
393-
If your company uses a user login method not supported by Symfony, you can
394-
develop :doc:`your own user provider </security/custom_provider>` and
395-
:doc:`your own authentication provider </security/custom_authentication_provider>`.
396-
397-
----
398-
399379
Next: :doc:`/best_practices/web-assets`
400380

401381
.. _`ParamConverter`: https://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/converters.html

‎controller/error_pages.rst

+9-2
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ logic to determine the template filename:
6060
a generic template for the given format (like ``error.json.twig`` or
6161
``error.xml.twig``);
6262

63-
#. If none of the previous template exist, fall back to the generic HTML template
63+
#. If none of the previous templates exist, fall back to the generic HTML template
6464
(``error.html.twig``).
6565

6666
.. _overriding-or-adding-templates:
@@ -69,7 +69,7 @@ To override these templates, rely on the standard Symfony method for
6969
:ref:`overriding templates that live inside a bundle <override-templates>` and
7070
put them in the ``templates/bundles/TwigBundle/Exception/`` directory.
7171

72-
A typical project that returns HTML and JSON pages, might look like this:
72+
A typical project that returns HTML and JSON pages might look like this:
7373

7474
.. code-block:: text
7575
@@ -122,6 +122,13 @@ store the HTTP status code and message respectively.
122122
for the standard HTML exception page or ``exception.json.twig`` for the JSON
123123
exception page.
124124

125+
Security & 404 Pages
126+
--------------------
127+
128+
Due to the order of how routing and security are loaded, security information will
129+
*not* be available on your 404 pages. This means that it will appear as if your
130+
user is logged out on the 404 page (it will work while testing, but not on production).
131+
125132
.. _testing-error-pages:
126133

127134
Testing Error Pages during Development

‎doctrine.rst

+50-2
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,8 @@ This command executes all migration files that have not already been run against
228228
your database. You should run this command on production when you deploy to keep
229229
your production database up-to-date.
230230

231+
.. _doctrine-add-more-fields:
232+
231233
Migrations & Adding more Fields
232234
-------------------------------
233235

@@ -715,12 +717,58 @@ relationships.
715717

716718
For info, see :doc:`/doctrine/associations`.
717719

720+
.. _doctrine-fixtures:
721+
718722
Dummy Data Fixtures
719723
-------------------
720724

721725
Doctrine provides a library that allows you to programmatically load testing
722-
data into your project (i.e. "fixture data"). For information, see
723-
the "`DoctrineFixturesBundle`_" documentation.
726+
data into your project (i.e. "fixture data"). Install it with:
727+
728+
.. code-block:: terminal
729+
730+
$ composer require doctrine/doctrine-fixtures-bundle --dev
731+
732+
Then, use the ``make:fixtures`` command to generate an empty fixture class:
733+
734+
.. code-block:: terminal
735+
736+
$ php bin/console make:fixtures
737+
738+
The class name of the fixtures to create (e.g. AppFixtures):
739+
> ProductFixture
740+
741+
Customize the new class to load ``Product`` objects into Doctrine::
742+
743+
// src/DataFixtures/ProductFixture.php
744+
namespace App\DataFixtures;
745+
746+
use Doctrine\Bundle\FixturesBundle\Fixture;
747+
use Doctrine\Common\Persistence\ObjectManager;
748+
749+
class ProductFixture extends Fixture
750+
{
751+
public function load(ObjectManager $manager)
752+
{
753+
$product = new Product();
754+
$product->setName('Priceless widget!');
755+
$product->setPrice(14.50);
756+
$product->setDescription('Ok, I guess it *does* have a price');
757+
$manager->persist($product);
758+
759+
// add more products
760+
761+
$manager->flush();
762+
}
763+
}
764+
765+
Empty the database and reload *all* the fixture classes with:
766+
767+
.. code-block:: terminal
768+
769+
$ php bin/console doctrine:fixtures:load
770+
771+
For information, see the "`DoctrineFixturesBundle`_" documentation.
724772

725773
Learn more
726774
----------

‎doctrine/registration_form.rst

+10-10
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,19 @@ First, make sure you have all the dependencies you need installed:
1616
1717
$ composer require symfony/orm-pack symfony/form symfony/security-bundle symfony/validator
1818
19-
.. tip::
20-
21-
The popular `FOSUserBundle`_ provides a registration form, reset password
22-
form and other user management functionality.
23-
2419
If you don't already have a ``User`` entity and a working login system,
25-
first start with :doc:`/security/entity_provider`.
20+
first start by following :doc:`/security`.
2621

2722
Your ``User`` entity will probably at least have the following fields:
2823

2924
``username``
3025
This will be used for logging in, unless you instead want your user to
31-
:ref:`login via email <registration-form-via-email>` (in that case, this
26+
:ref:`log in via email <registration-form-via-email>` (in that case, this
3227
field is unnecessary).
3328

3429
``email``
3530
A nice piece of information to collect. You can also allow users to
36-
:ref:`login via email <registration-form-via-email>`.
31+
:ref:`log in via email <registration-form-via-email>`.
3732

3833
``password``
3934
The encoded password.
@@ -166,7 +161,7 @@ With some validation added, your class may look something like this::
166161
The :class:`Symfony\\Component\\Security\\Core\\User\\UserInterface` requires
167162
a few other methods and your ``security.yaml`` file needs to be configured
168163
properly to work with the ``User`` entity. For a more complete example, see
169-
the :ref:`Entity Provider <security-crete-user-entity>` article.
164+
the :doc:`Security Guide </security>`.
170165

171166
.. _registration-password-max:
172167

@@ -420,6 +415,11 @@ To do this, add a ``termsAccepted`` field to your form, but set its
420415
The :ref:`constraints <form-option-constraints>` option is also used, which allows
421416
us to add validation, even though there is no ``termsAccepted`` property on ``User``.
422417

418+
Manually Authenticating after Success
419+
-------------------------------------
420+
421+
If you're using Guard authentication, you can :ref:`automatically authenticate <guard-manual-auth>`
422+
after registration is successful.
423+
423424
.. _`CVE-2013-5750`: https://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form
424-
.. _`FOSUserBundle`: https://github.com/FriendsOfSymfony/FOSUserBundle
425425
.. _`bcrypt`: https://en.wikipedia.org/wiki/Bcrypt

‎reference/configuration/security.rst

+1-2
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ is set to ``true``) when they try to access a protected resource but isn't
4848
fully authenticated.
4949

5050
This path **must** be accessible by a normal, un-authenticated user, else
51-
you may create a redirect loop. For details, see
52-
":ref:`Avoid Common Pitfalls <security-common-pitfalls>`".
51+
you may create a redirect loop.
5352

5453
check_path
5554
..........

‎reference/configuration/web_profiler.rst

+2
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ It enables and disables the toolbar entirely. Usually you set this to ``true``
4545
in the ``dev`` and ``test`` environments and to ``false`` in the ``prod``
4646
environment.
4747

48+
.. _intercept_redirects:
49+
4850
intercept_redirects
4951
~~~~~~~~~~~~~~~~~~~
5052

‎reference/twig_reference.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ expression
430430
~~~~~~~~~~
431431

432432
Creates an :class:`Symfony\\Component\\ExpressionLanguage\\Expression` in
433-
Twig. See ":ref:`Template Expressions <security-template-expression>`".
433+
Twig.
434434

435435
.. _reference-twig-filters:
436436

0 commit comments

Comments
 (0)