Secure User Registration with Bcrypt

Welcome to the first lesson in our course "Securing Your Symfony App". In this lesson, we'll focus on implementing secure user registration using Bcrypt for password hashing, a crucial part of any web application.

User registration with secure password storage helps in:

• Creating unique user accounts for personalized experiences.
• Enhancing security by controlling access to different parts of the application.
• Tracking user interactions and preferences.
• Protecting user credentials through secure password hashing.

By the end of this lesson, you will be able to set up a secure user registration feature in your Symfony application using Bcrypt for hashing passwords. This foundational knowledge will be valuable as we explore more advanced authentication strategies in future lessons.

Let's start by creating the User entity, which will represent the users of our application.

<?php

namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;

#[ORM\Entity]
#[ORM\Table(name: "users")]
class User
{
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column(type: "integer")]
    private $id;

    #[ORM\Column(type: "string", length: 50, unique: true)]
    private $username;

    #[ORM\Column(type: "string")]
    private $password;

    // Getters and setters...
}

In this code, we define a User entity class using Doctrine ORM annotations to specify how it maps to the underlying database. The #[ORM\Entity] annotation indicates that this is a Doctrine entity, and the #[ORM\Table] annotation specifies the table name and constraints.

The entity has three main properties: id, username, and password. The id is the primary key and is auto-generated. The username is a unique string field, and the password is also stored as a string. The class includes getter and setter methods to interact with these properties.

Next, we need a repository to interact with the user data in the database.

<?php

namespace App\Repository;

use App\Entity\User;
use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
use Doctrine\Persistence\ManagerRegistry;

class UserRepository extends ServiceEntityRepository
{
    public function __construct(ManagerRegistry $registry)
    {
        parent::__construct($registry, User::class);
    }

    public function findByUsername(string $username): ?User
    {
        return $this->findOneBy(['username' => $username]);
    }
}

The UserRepository extends Doctrine's ServiceEntityRepository, which provides convenient methods for database operations. It includes a custom method findByUsername to retrieve a user by their username, allowing us to encapsulate query logic within the repository.

The service layer provides a clean way to handle the application logic related to users. This allows for a clean separation between the controller logic and database operations.

<?php

namespace App\Service;

use App\Entity\User;
use App\Repository\UserRepository;
use Doctrine\ORM\EntityManagerInterface;

class UserService
{
    private $entityManager;
    private $userRepository;

    public function __construct(EntityManagerInterface $entityManager, UserRepository $userRepository)
    {
        $this->entityManager = $entityManager;
        $this->userRepository = $userRepository;
    }

    public function create(array $data): User
    {
        $user = new User();
        $user->setUsername($data['username']);
        // Hash the password using bcrypt
        $hashedPassword = password_hash($data['password'], PASSWORD_BCRYPT);
        $user->setPassword($hashedPassword);
        $this->entityManager->persist($user);
        $this->entityManager->flush();
        return $user;
    }

    public function findByUsername(string $username): ?User
    {
        return $this->userRepository->findByUsername($username);
    }
}

Here, the UserService class uses dependency injection to receive the EntityManagerInterface and UserRepository instances. It has a main method create, which creates a new user and saves it to the database after hashing the password using Bcrypt. Using Bcrypt for hashing ensures that passwords are securely stored, enhancing the security of our application. This service layer separates the business logic from the controller, making the code more modular and maintainable.

Bcrypt's adjustable cost factor increases security by making brute-force attacks harder. The password_hash() function uses Bcrypt with a default cost of 10, meaning it performs 2^10 (1024) hashing iterations. Although increasing the cost factor boosts security, it can slow down the login process, so it’s important to balance. You can customize the cost factor as shown:

$options = ['cost' => 12];
$hashedPassword = password_hash($data['password'], PASSWORD_BCRYPT, $options);
$user->setPassword($hashedPassword);

This customization allows you to tailor the hashing process to meet specific security needs while considering performance.

The controller will handle HTTP requests and responses related to user registration.

<?php

namespace App\Controller;

use App\Service\UserService;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\HttpFoundation\Request;

class UserController
{
    private $userService;

    public function __construct(UserService $userService)
    {
        $this->userService = $userService;
    }

    /**
     * @Route("/users/register", name="register", methods={"POST"})
     */
    public function register(Request $request): JsonResponse
    {
        $data = json_decode($request->getContent(), true);
        $user = $this->userService->create($data);
        return new JsonResponse(['username' => $user->getUsername()]);
    }
}

In this code, we define a route for user registration that handles POST requests. The register method creates a new user and returns the username in the response.

Finally, we need to configure the services in Symfony.

# app/config/services.yaml
services:
    # default configuration for services in *this* file
    _defaults:
        autowire: true      # Automatically injects dependencies in your services.
        autoconfigure: true # Automatically registers your services as commands, event subscribers, etc.

    # makes classes in src/ available to be used as services
    App\:
        resource: '../src/'
        exclude:
            - '../src/DependencyInjection/'
            - '../src/Entity/'
            - '../src/Kernel.php'

    App\Controller\UserController:
        public: true
        tags: ['controller.service_arguments']

In the above services.yaml configuration, the line App\Controller\UserController: public: true tags: ['controller.service_arguments'] ensures that the UserController is publicly accessible and that its constructor arguments are correctly injected. This is necessary for the controller to function properly within the Symfony framework.

In this lesson, we have covered:

• Entity Creation: We created the User entity with Doctrine ORM.
• Repository Setup: We set up the UserRepository for database interactions.
• Service Implementation: We built the UserService for handling business logic, including secure password hashing with Bcrypt.
• Controller Development: We created the UserController to handle secure registration.
• Configuration: We configured services.

Now that you have a foundational understanding of how to implement secure user registration in Symfony using Bcrypt, it's time to put this knowledge into practice. Use the provided examples and explanations to complete the exercises and reinforce your learning.