Implementing Login and Securing Routes

Welcome back! In the previous lesson, we enhanced the security of our Symfony MVC application by hashing passwords during user registration. Now, it's time to take another crucial step in securing our application: implementing user login and securing routes.

Authentication ensures that only registered users can access certain parts of your application, while authorization controls what those users can do within the app. By the end of this lesson, you will be able to add user login functionality and secure routes in your Symfony MVC application.

Before we start implementing the security features, we need to ensure that Symfony's security bundle is installed in our project. This bundle provides all the necessary tools and configuration options to manage authentication and authorization.

To install the security bundle, run the following Composer command:

composer require symfony/security-bundle

This command will add the security bundle to your project, and Symfony will automatically update your configuration files to include the default security settings.

First, we need to make our User entity compatible with Symfony's security system, which requires that the entity implement UserInterface and PasswordAuthenticatedUserInterface. These interfaces define the methods necessary for authentication and password management.

Here’s how we update our User entity to implement these interfaces:

<?php

namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;

#[ORM\Entity(repositoryClass: "App\Repository\UserRepository")]
#[ORM\Table(name: "users")]
#[ORM\UniqueConstraint(name: "username_unique", columns: ["username"])]
class User implements UserInterface, PasswordAuthenticatedUserInterface
{
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column(type: "integer")]
    private $id;

    #[ORM\Column(type: "string", length: 255, unique: true)]
    private $username;

    #[ORM\Column(type: "string", length: 255)]
    private $password; // Hashed password

    #[ORM\Column(type: "json")]
    private array $roles = [];

    // Other methods previously implemented...

    public function getRoles(): array
    {
        $roles = $this->roles;
        $roles[] = 'ROLE_USER';

        return array_unique($roles);
    }

    public function setRoles(array $roles): self
    {
        $this->roles = $roles;

        return $this;
    }

    public function eraseCredentials()
    {
        // If you store any temporary, sensitive data, clear it here
    }
}

We implement the UserInterface and PasswordAuthenticatedUserInterface in our User entity to allow Symfony to handle our users correctly for authentication. This ensures that our Symfony application can identify users accurately and manage their roles. For instance, the getRoles() method returns the roles assigned to the user, ensuring every user has at least the role ROLE_USER.

Next, we need to ensure that every new user gets a default role. In our UserService, we set the user's role when we create a new user:

<?php

namespace App\Service;

use App\Entity\User;
use App\Repository\UserRepository;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;

class UserService
{
    // Properties, constructor and other methods...

    public function create(string $username, string $plainPassword): User
    {
        $user = new User();
        $user->setUsername($username);

        $hashedPassword = $this->passwordHasher->hashPassword($user, $plainPassword);
        $user->setPassword($hashedPassword);

        $user->setRoles(['ROLE_USER']); // Set default role as 'ROLE_USER'

        $this->entityManager->persist($user);
        $this->entityManager->flush();

        return $user;
    }
}

In the create method, we set a default role ROLE_USER using the setRoles method. This ensures every new user has the role required to access protected routes. By doing this, we control user permissions right from the moment a new user is created, making the application secure by default.

Before we dive into configuring our security settings, let's take a moment to understand how Symfony's security bundle works. This bundle is crucial for managing authentication (verifying who a user is) and authorization (determining what a user is allowed to do).

There are several key components within the security bundle:

1. Firewalls: Think of firewalls as gatekeepers that manage the login process and protect certain parts of your application. Firewalls decide whether a user can enter based on their credentials.
2. Providers: These retrieve user information, like usernames and passwords, from a data source, such as a database.
3. Encoders/Password Hashers: Tools that securely encode and check user passwords.
4. Access Control: Rules that define which users or roles have permission to access specific parts of your application.

All these components are configured in a special file called security.yaml. This file is located in the config/packages/ directory of your Symfony project. The security.yaml file is essentially the control center for handling how users log in and what they can do within your app. By setting up this file correctly, you ensure your application is secure and that users only access what they are supposed to.

Let's start by understanding how to configure the security settings in the security.yaml file:

security:
    # Enables the new authenticator-based system
    enable_authenticator_manager: true

    password_hashers:
        App\Entity\User:
            # Automatically select the best hashing algorithm
            algorithm: auto

    providers:
        app_user_provider:
            entity:
                # User entity class
                class: App\Entity\User
                # Unique property used to load the user
                property: username

Here’s what each section does:

• enable_authenticator_manager: This enables Symfony’s new system for handling authentication.
• password_hashers: This part configures how passwords are hashed (encrypted) when users are interacting with our User entity.
• providers: This defines where Symfony should look for user data. We specify the User entity and the unique identifier (username) used to load the user.

Now we will set up the firewalls that control access to different parts of our application:

    firewalls:
        dev:
            # Matches paths for development tools and assets
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            # Disable security for these paths
            security: false

        main:
            # Lazy load the firewall
            lazy: true
            # Use the app_user_provider for user data
            provider: app_user_provider

            form_login:
                # Path to the login page and login check route
                login_path: user_auth
                check_path: user_auth
                # Default path after successful login
                default_target_path: todo_list
                # Always redirect to the default path after login
                always_use_default_target_path: true

Here’s a breakdown:

• dev firewall: Disables security for development tools and assets like CSS and JavaScript files.
• main firewall: This is where the main application security is configured with form_login for handling user login:
  • login_path: The route for displaying the login form.
  • check_path: The same route used to check login credentials.
  • default_target_path: Where users are redirected after a successful login.
  • always_use_default_target_path: Always redirect users to the default path after login.

Even if you haven’t explicitly created a login route, Symfony manages this process using these settings. You simply specify where the login form should be shown and where to redirect after login.

Finally, we define access rules based on user roles:

    access_control:
        # Require ROLE_USER for routes with /todos
        - { path: ^/todos, roles: ROLE_USER }
        # Allow public access to other routes
        - { path: ^/, roles: PUBLIC_ACCESS }

Here’s how it works:

• ROLE_USER for /todos: Only users with the ROLE_USER can access routes starting with /todos.
• PUBLIC_ACCESS for other routes: Everyone can access other routes, including the authentication page, without needing to log in.

These rules ensure that only authorized users can access certain routes, while still allowing public access to other essential routes. This makes your application secure by default.

To complete the implementation, we need a user-friendly login interface. We'll create a simple login form using Twig:

<!DOCTYPE html>
<html>
<head>
    <title>User Authentication</title>
</head>
<body>
    <h1>User Authentication</h1>

    {% for message in app.flashes('success') %}
        <div class="flash-success">
            {{ message }}
        </div>
    {% endfor %}

    {% for message in app.flashes('error') %}
        <div class="flash-error">
            {{ message }}
        </div>
    {% endfor %}

    <form action="{{ path('user_auth') }}" method="post">
        <label for="username">Username:</label>
        <input type="text" id="username" name="_username" required><br><br>

        <label for="password">Password:</label>
        <input type="password" id="password" name="_password" required><br><br>

        <button type="submit" formaction="{{ path('user_register') }}">Register</button>
        <button type="submit">Login</button>
    </form>
</body>
</html>

This HTML form provides fields for the username and password. The login_path is set to the user_auth route, defined in security.yaml. Here's how this works as a login system:

• Route Definition: The user_auth route refers to a controller action responsible for rendering this login template as well as handling the form submission.
• Form Submission: When a user submits the form, the credentials are sent via POST to the same user_auth route.
• Form Handling: Symfony automatically processes the login credentials, validates them against the user data from the provider, and checks the hashed passwords.
• Redirection: If the authentication is successful, the user is redirected to the default_target_path (todo_list), as set in security.yaml.

By defining the user_auth route and integrating it with Symfony's form login mechanism, we ensure the form serves both as a login page and a handler for the login process, making the system both efficient and secure.

Understanding the login process in Symfony is crucial for effectively securing your application. Here’s an overview of how the login process works:

1. User Submits Login Form: The user fills in their username and password and submits the login form. The form action directs the data to the user_auth route.

2. Symfony Handles Authentication: Symfony receives the login credentials and uses the security component to handle authentication. The form data (_username and _password) are processed by Symfony's security system.

3. Fetching User Data: The security component uses the specified provider (app_user_provider) to fetch the user data from the database based on the provided username.

4. Password Verification: The fetched user data includes the hashed password. Symfony uses the password hasher configured in security.yaml to verify the password by comparing the submitted password with the hashed one stored in the database.

5. Role Checking: Symfony checks the roles assigned to the user, ensuring they can access the requested resource. The roles are specified in the User entity and controlled through the access_control settings in security.yaml.

6. Setting the Session: If the authentication is successful, Symfony sets the user’s session, effectively logging them in.

7. Redirecting the User: Upon successful authentication, Symfony redirects the user to the default_target_path (e.g., todo_list), as specified in the security.yaml file. If authentication fails, the user is redirected back to the login page.

8. Access Control: On subsequent requests, Symfony uses the session data to verify the user's identity and roles, granting or denying access to different parts of the application based on the access_control settings.

This process ensures that only authenticated users can access protected routes, providing a secure way to manage user access in your Symfony application.

In this lesson, we covered:

• How to implement the UserInterface and PasswordAuthenticatedUserInterface in the User entity.
• Setting default roles in the UserService.
• Configuring the security.yaml for user login and route protection.
• Adapting the login template for a user-friendly experience.

These steps are crucial in ensuring that your Symfony application is secure and only accessible to authenticated users.

Next, you will have the opportunity to apply what you've learned through practice exercises. These exercises will help you reinforce the concepts and techniques covered in this lesson. Keep practicing to solidify your understanding and build a more secure Symfony application. Keep up the great work!