Symfony Framework Deepdive - Security
Symfony Framework Deepdive - Security
A deepdive into the Symfony security component
About the Book
Many PHP developers are great specialists and know their way around PHP like the back of their hand. However, when a powerful framework like Symfony is built, it also includes software patterns and designs, which even the most experienced developers need to learn. This book is aimed to teach you exactly that.
The security component is the most complex and least known component of the whole Symfony2 infrastructure. This is mostly because all security work is accomplished by very flexible third party bundles. And, it is exactly this flexibility, which also makes the flow and processes within the component difficult to follow. Access managers, token providers, trust deciders, firewall maps, authorization listeners – these are just a few of the rarely heard of and even less understood inner workings of the security component, which are actually vital and very useful parts of it.
In this book, we'll dive into the security components (yes, there are actually more than one!) of the Symfony2 framework, along with the supporting bridges, to show you how all of the components fit and work together. Furthermore, you will learn about ALL of the configuration options of the security.yml file and how these options affect the security processes within Symfony. You will also learn how to implement the security component in a non-framework app or in your own custom framework.
Besides these internals, we will also go through some recipes to solve common problems, in order to give you a solid basis to solve your own.
About the Symfony Rainbow Series:The Symfony Rainbow Series is a collection of books, which describe, in detail, the different components that make up the Symfony framework. Every book will concentrate on a single component or a set of smaller components. The books will describe the component's inner workings and also give you recipes to solve common problems quickly and efficiently.
These books are intended for PHP developers with any level of knowledge of Symfony, from beginner to expert. They are especially made for those developers, who work with or want to work with Symfony and want to also do their programming with Symfony as smartly and efficiently as possible. If you would like to learn exactly how the inner workings of Symfony function together as a framework or how to use the wide range of Symfony components in a standalone fashion, then these books are for you!
About the Author
Bundles that include this book
Table of Contents
-
Introduction
- About the Symfony rainbow series
- About those who will read this book
- About those I’d like to thank
- About the security component
- 1. The big picture
-
The Security Core Component
-
2. The core component
- 2.1 Directory layout
-
3. Security context
- 3.1 The security context in Symfony 2.5
- 3.2 The security context in Symfony 2.6
-
4. Tokens
- 4.1 Token authentication
- 4.2 Different tokens
-
5. Managers, managers everywhere!
- 5.1 The access decision manager
- 5.2 The authentication manager
- 5.3 The authentication providers
-
6. Users and user providers
- 6.1 About users
- 6.2 Password encoders
- 6.3 Utilities
- 6.4 Validators
- 7. A complete implementation
-
2. The core component
-
The Security HTTP Component
-
8. The HTTP component
- 8.1 About the firewall
- 8.2 Directory layout
-
9. Components
- 9.1 Security listeners
- 9.2 Entry points
- 9.3 Rememember-me
- 9.4 Logout handlers
- 9.5 Session strategy
- 9.6 Authentication handlers
-
8. The HTTP component
-
The Security CSRF Component
- 10. Cross Site Request Forgery (CSRF)
-
11. The CSRF security component
- 11.1 Directory layout
- 11.2 Checking tokens
- 11.3 Creating tokens
-
The Security ACL Component
-
12. The ACL component
- 12.1 ACL terminology
- 12.2 Directory layout
-
13. Access Control Lists
- 13.1 How the ACL component works
-
14. Permissions
- 14.1 Storing permissions
- 14.2 Checking permissions
- 14.3 Setting multiple permissions
-
15. Advanced ACL techniques
- 15.1 Using parent ACLs
- 15.2 Using object fields
- 15.3 Class scope vs object scope
- 15.4 Creating custom permissions
- 15.5 Custom voters vs ACLs
- 15.6 ACL Auditing
-
16. Database storage
- 16.1 The ACL Schema
-
17. ACL internals
- 17.1 The ACL voter
- 17.2 The ACL provider
- 17.3 The lookupObjectIdentities method
- 17.4 The hydrateObjectIdentities method
- 17.5 The permissionGrantingStrategy
- 17.6 The isAceApplicable method
-
12. The ACL component
-
The Security Bundle
-
18. The glue that binds them
- 18.1 Directory layout
-
19. Building the service container
- 19.1 The SecurityBundle
- 19.2 The factories
- 19.3 The MainConfiguration
- 19.4 The SecurityExtension
-
18. The glue that binds them
-
The Security Configuration
-
20. The security configuration
- 20.1 Global configuration
- 20.2 Access decision manager configuration
- 20.3 ACL configuration
- 20.4 Encoders configuration
- 20.5 Provider configuration
- 20.6 Firewall configuration
- 20.7 Firewall authenticator configuration
- 20.8 Access control configuration
- 20.9 Role hierarchy configuration
-
20. The security configuration
-
The Security Bridges
-
21. The Doctrine bridge
- 21.1 DoctrineTokenProvider
- 21.2 EntityUserProvider
-
22. The Propel1 bridge
- 22.1 EntityUserProvider
-
23. The Twig bridge
- 23.1 SecurityExtension
-
21. The Doctrine bridge
-
Recipes
- 24. Using recipes
- 25. Recipe 1: Creating an office hour voter
- 26. Recipe 2: Advanced switch user
- 27. Recipe 3: Permit only one user login
- 28. Recipe 4: Logging information about logins
- 29. Recipe 5: Two factor authentication
- 30. Recipe 6: Auto-login through URL
- 31. Recipe 7: Programmatically log in a user
- 32. Recipe 8: Authenticate users from subdomains
- 33. Recipe 9: Timeout user after failed login attempts
- Further reading
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Do Well. Do Good.
Authors have earned$11,020,212writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
- #1
Retrocomputing with Clash
Gergő ÉrdiHaskell for FPGA Hardware Design: Use abstractions like monads and lenses to implement 1970's retro-computing devices like arcade machines and home computers.
- #2
Aprendiendo Git
Miguel Angel Durán GarcíaGit no es complicado... ¡Si lo entiendes! 😜
¿Sientes que sabes usarlo porque has memorizado todos los comandos que necesitas? ¡Pero no entiendes qué hace cada cosa y por qué! Así es normal que, cuando exista un problema, te cueste resolverlo.
¡Con este libro vas a entender de una vez por todas todo lo que es Git y cómo sacarle provecho!
- #3
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
- #4
Jetpack Compose internals
Jorge CastilloJetpack Compose is the future of Android UI. Master how it works internally and become a more efficient developer with it. You'll also find it valuable if you are not an Android dev. This book provides all the details to understand how the Compose compiler & runtime work, and how to create a client library using them.
- #5
Atomic Kotlin
Bruce Eckel and Svetlana IsakovaFor both beginning and experienced programmers! From the author of the multi-award-winning Thinking in C++ and Thinking in Java and a Kotlin team member comes a book that breaks concepts into small, easy-to-digest "atoms," along with exercises supported by hints and solutions directly inside IntelliJ IDEA! Full support at www.AtomicKotlin.com.
- #6
Stratospheric
Tom Hombergs, Björn Wilmsmann, and Philip RiecksFrom Zero to Production with Spring Boot and AWS. All you need to know to get a Spring Boot application into production with AWS. No previous AWS knowledge required.
Go to stratospheric.dev for a tour of the contents.
- #7
Functional Programming Made Easier
Charles ScalfaniA Functional Programming book from beginner to advanced without skipping a single step along the way.
In my 40 years of programming, I've felt that programming books always let me down, especially Functional Programming books. So, I wrote the book I wish I had 5 years ago.
Functional Programming will never be easy, but it can be easier.
- #8
C++20 - The Complete Guide
Nicolai M. JosuttisAll the new language and library features of C++20 (for those who know previous versions).
The book presents all new language and library features of C++20. Learn how this impacts day-to-day programming, to benefit in practice, to combine new features, and to avoid all new traps.
Buy early, pay less, free updates.
Other books:
- #9
Cloud Strategy
Gregor Hohpe“Strategy is the difference between making a wish and making it come true.” A successful migration to the cloud can transform your organization, but it shouldn’t be driven by wishes. This book tells you how to develop a sound strategy guided by frameworks and decision models without being overly abstract nor getting lost in product details.
- #10
Continuous Delivery Pipelines
Dave FarleyThis practical handbook provides a step-by-step guide for you to get the best continuous delivery pipeline for your software.
Top Bundles
- #1
CCIE Service Provider Ultimate Study Bundle
2 Books
Piotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification... - #2
Practical FP in Scala + Functional event-driven architecture
2 Books
Practical FP in Scala (A hands-on approach) & Functional event-driven architecture, aka FEDA, (Powered by Scala 3), together as a bundle! The content of PFP in Scala is a requirement to understand FEDA so why not take advantage of this bundle!? - #4
Linux Administration Complet
4 Books
Ce lot comprend les quatre volumes du Guide Linux Administration :Linux Administration, Volume 1, Administration fondamentale : Guide pratique de préparation aux examens de certification LPIC 1, Linux Essentials, RHCSA et LFCS. Administration fondamentale. Introduction à Linux. Le Shell. Traitement du texte. Arborescence de fichiers. Sécurité... - #5
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books
"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before... - #7
Retromat eBook Bundle for Agile Retrospectives
2 Books
If you facilitate retrospectives this bundle is for you: "Plans for Retrospectives" helps beginners learn the lay of the land with tried-and-true plans. Once you know your way around, "Run great agile retrospectives" contains all 135+ activities in Retromat for you to mix and match. - #9
Pattern-Oriented Memory Forensics and Malware Detection
2 Books
This training bundle for security engineers and researchers, malware and memory forensics analysts includes two accelerated training courses for Windows memory dump analysis using WinDbg. It is also useful for technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible... - #10
Books on problem-solving using Agile, Lean, Complexity, and more
6 Books
Six great books on problem-solving. Learn how to deal with impediments using agile practices, do A3 problem-solving with lean thinking, apply complexity science, finding root causes, and do event storming. All in one buy for a largely reduced price! Books included Agile teams need to be able to handle impediments. The book Problem? What Problem?...
