Symfony2 : how to check if an action is secured? - php

Question

I would like to check from inside a controller if it is a secured page or not.
How to do this ?
My use case is the following :
User can register and log in
If he logs in and tries to access a secured page, he will be redirected to a "beta version" page until the end of June.
If he tries to access a normal page (not secured), he will be able to access it without any redirection.
Thanks for your help !
Aurel

Answer 1

When Symfony2 processes a request it matches the url pattern with each firewall defined in app/config/security.yml. When url pattern matches with a pattern of the firewall Symfony2 creates some listener objects and call handle method of those objects. If any listener returns a Response object then the loop breaks and Symfony2 outputs the response. Authentication part is done in authentication listeners. They are created from config defined in matched firewall e.g form_login, http_basic etc. If user is not authenticated then authenticated listeners create a RedirectResponse object to redirect user to login page. For your case, you can cheat by creating a custom authentication listener and add it in your secured page firewall. Sample implementation would be following,
Create a Token class,
namespace Your\Namespace;
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
class MyToken extends AbstractToken
{
public function __construct(array $roles = array())
{
parent::__construct($roles);
}
public function getCredentials()
{
return '';
}
}
Create a class that implements AuthenticationProviderInterface. For form_login listener it authenticates with the given UserProvider. In this case it will do nothing.
namespace Your\Namespace;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
use Acme\BaseBundle\Firewall\MyToken;
class MyAuthProvider implements AuthenticationProviderInterface
{
public function authenticate(TokenInterface $token)
{
if (!$this->supports($token)) {
return null;
}
throw new \Exception('you should not get here');
}
public function supports(TokenInterface $token)
{
return $token instanceof MyToken;
}
Create an entry point class. The listener will create a RedirectResponse from this class.
namespace Your\Namespace;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
use Symfony\Component\Security\Http\HttpUtils;
class MyAuthenticationEntryPoint implements AuthenticationEntryPointInterface
{
private $httpUtils;
private $redirectPath;
public function __construct(HttpUtils $httpUtils, $redirectPath)
{
$this->httpUtils = $httpUtils;
$this->redirectPath = $redirectPath;
}
/**
* {#inheritdoc}
*/
public function start(Request $request, AuthenticationException $authException = null)
{
//redirect action goes here
return $this->httpUtils->createRedirectResponse($request, $this->redirectPath);
}
Create a listener class. Here you will implement your redirection logic.
namespace Your\Namespace;
use Symfony\Component\Security\Http\Firewall\ListenerInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\Security\Core\SecurityContextInterface;
use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
class MyAuthenticationListener implements ListenerInterface
{
private $securityContext;
private $authenticationEntryPoint;
public function __construct(SecurityContextInterface $securityContext, AuthenticationEntryPointInterface $authenticationEntryPoint)
{
$this->securityContext = $securityContext;
$this->authenticationEntryPoint = $authenticationEntryPoint;
}
public function handle(GetResponseEvent $event)
{
$token = $this->securityContext->getToken();
$request = $event->getRequest();
if($token === null){
return;
}
//add your logic
$redirect = // boolean value based on your logic
if($token->isAuthenticated() && $redirect){
$response = $this->authenticationEntryPoint->start($request);
$event->setResponse($response);
return;
}
}
}
Create the services.
<?xml version="1.0" ?>
<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
<services>
<service id="my_firewall.security.authentication.listener"
class="Your\Namespace\MyAuthenticationListener"
parent="security.authentication.listener.abstract"
abstract="true">
<argument type="service" id="security.context" />
<argument /> <!-- Entry Point -->
</service>
<service id="my_firewall.entry_point" class="Your\Namespace\MyAuthenticationEntryPoint" public="false" ></service>
<service id="my_firewall.auth_provider" class="Your\Namespace\MyAuthProvider" public="false"></service>
</services>
</container>
Register the listener. Create a folder named Security/Factory in your bundles DependencyInjection folder. Then create the factory class.
namespace Your\Bundle\DependencyInjection\Security\Factory;
use Symfony\Component\DependencyInjection\ContainerBuilder;
use Symfony\Component\DependencyInjection\Reference;
use Symfony\Component\DependencyInjection\DefinitionDecorator;
use Symfony\Component\DependencyInjection\Definition;
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
use Symfony\Component\Config\Definition\Builder\NodeDefinition;
class MyFirewallFactory implements SecurityFactoryInterface
{
public function create(ContainerBuilder $container, $id, $config, $userProvider, $defaultEntryPoint)
{
$provider = 'my_firewall.auth_provider.'.$id;
$container->setDefinition($provider, new DefinitionDecorator('my_firewall.auth_provider'));
// entry point
$entryPointId = $this->createEntryPoint($container, $id, $config, $defaultEntryPoint);
// listener
$listenerId = 'my_firewall.security.authentication.listener'.$id;
$listener = $container->setDefinition($listenerId, new DefinitionDecorator('my_firewall.security.authentication.listener'));
$listener->replaceArgument(1, new Reference($entryPointId));
return array($provider, $listenerId, $entryPointId);
}
public function getPosition()
{
return 'pre_auth';
}
public function getKey()
{
return 'my_firewall'; //the listener name
}
protected function getListenerId()
{
return 'my_firewall.security.authentication.listener';
}
public function addConfiguration(NodeDefinition $node)
{
$node
->children()
->scalarNode('redirect_path')->end()
->end()
;
}
protected function createEntryPoint($container, $id, $config, $defaultEntryPointId)
{
$entryPointId = 'my_firewall.entry_point'.$id;
$container
->setDefinition($entryPointId, new DefinitionDecorator('my_firewall.entry_point'))
->addArgument(new Reference('security.http_utils'))
->addArgument($config['redirect_path'])
;
return $entryPointId;
}
}
Then in your NamespaceBundle.php of your bundle folder add the following code.
public function build(ContainerBuilder $builder){
parent::build($builder);
$extension = $builder->getExtension('security');
$extension->addSecurityListenerFactory(new Security\Factory\MyFirewallFactory());
}
Authentication listener is created, phew :). Now in your app/config/security.yml do following.
api_area:
pattern: ^/secured/
provider: fos_userbundle
form_login:
check_path: /login_check
login_path: /login
csrf_provider: form.csrf_provider
my_firewall:
redirect_path: /beta
logout: true
anonymous: true

Answer 2

I dont know if this is the correct method
But you can try the following
/vendor/symfony/src/Symfony/Component/HttpKernel/HttpKernel.php has a method handleRaw that converts a request to a response . The request object is accessable from there . You can check if the client has requested to access the secured page . If so , you can manually set the controller like
$request->attributes->set('_controller','your\Bundle\SecureBundle\Controller\SecureController::secureAction');
Another solution would be to set a session if the user try to access a secured page and check for the same inside your controller
Again , this might not be the correct method but it is a possible workaround