Symfony Framework Deepdive - Security
This book is 100% complete
Completed on 2015-02-03
About the Book
Many PHP developers are great specialists and know their way around PHP like the back of their hand. However, when a powerful framework like Symfony is built, it also includes software patterns and designs, which even the most experienced developers need to learn. This book is aimed to teach you exactly that.
The security component is the most complex and least known component of the whole Symfony2 infrastructure. This is mostly because all security work is accomplished by very flexible third party bundles. And, it is exactly this flexibility, which also makes the flow and processes within the component difficult to follow. Access managers, token providers, trust deciders, firewall maps, authorization listeners – these are just a few of the rarely heard of and even less understood inner workings of the security component, which are actually vital and very useful parts of it.
In this book, we'll dive into the security components (yes, there are actually more than one!) of the Symfony2 framework, along with the supporting bridges, to show you how all of the components fit and work together. Furthermore, you will learn about ALL of the configuration options of the security.yml file and how these options affect the security processes within Symfony. You will also learn how to implement the security component in a non-framework app or in your own custom framework.
Besides these internals, we will also go through some recipes to solve common problems, in order to give you a solid basis to solve your own.
About the Symfony Rainbow Series:The Symfony Rainbow Series is a collection of books, which describe, in detail, the different components that make up the Symfony framework. Every book will concentrate on a single component or a set of smaller components. The books will describe the component's inner workings and also give you recipes to solve common problems quickly and efficiently.
These books are intended for PHP developers with any level of knowledge of Symfony, from beginner to expert. They are especially made for those developers, who work with or want to work with Symfony and want to also do their programming with Symfony as smartly and efficiently as possible. If you would like to learn exactly how the inner workings of Symfony function together as a framework or how to use the wide range of Symfony components in a standalone fashion, then these books are for you!
About the Author
Bundles that include this book
Table of Contents
-
Introduction
- About the Symfony rainbow series
- About those who will read this book
- About those I’d like to thank
- About the security component
- 1. The big picture
-
The Security Core Component
-
2. The core component
- 2.1 Directory layout
-
3. Security context
- 3.1 The security context in Symfony 2.5
- 3.2 The security context in Symfony 2.6
-
4. Tokens
- 4.1 Token authentication
- 4.2 Different tokens
-
5. Managers, managers everywhere!
- 5.1 The access decision manager
- 5.2 The authentication manager
- 5.3 The authentication providers
-
6. Users and user providers
- 6.1 About users
- 6.2 Password encoders
- 6.3 Utilities
- 6.4 Validators
- 7. A complete implementation
-
2. The core component
-
The Security HTTP Component
-
8. The HTTP component
- 8.1 About the firewall
- 8.2 Directory layout
-
9. Components
- 9.1 Security listeners
- 9.2 Entry points
- 9.3 Rememember-me
- 9.4 Logout handlers
- 9.5 Session strategy
- 9.6 Authentication handlers
-
8. The HTTP component
-
The Security CSRF Component
- 10. Cross Site Request Forgery (CSRF)
-
11. The CSRF security component
- 11.1 Directory layout
- 11.2 Checking tokens
- 11.3 Creating tokens
-
The Security ACL Component
-
12. The ACL component
- 12.1 ACL terminology
- 12.2 Directory layout
-
13. Access Control Lists
- 13.1 How the ACL component works
-
14. Permissions
- 14.1 Storing permissions
- 14.2 Checking permissions
- 14.3 Setting multiple permissions
-
15. Advanced ACL techniques
- 15.1 Using parent ACLs
- 15.2 Using object fields
- 15.3 Class scope vs object scope
- 15.4 Creating custom permissions
- 15.5 Custom voters vs ACLs
- 15.6 ACL Auditing
-
16. Database storage
- 16.1 The ACL Schema
-
17. ACL internals
- 17.1 The ACL voter
- 17.2 The ACL provider
- 17.3 The lookupObjectIdentities method
- 17.4 The hydrateObjectIdentities method
- 17.5 The permissionGrantingStrategy
- 17.6 The isAceApplicable method
-
12. The ACL component
-
The Security Bundle
-
18. The glue that binds them
- 18.1 Directory layout
-
19. Building the service container
- 19.1 The SecurityBundle
- 19.2 The factories
- 19.3 The MainConfiguration
- 19.4 The SecurityExtension
-
18. The glue that binds them
-
The Security Configuration
-
20. The security configuration
- 20.1 Global configuration
- 20.2 Access decision manager configuration
- 20.3 ACL configuration
- 20.4 Encoders configuration
- 20.5 Provider configuration
- 20.6 Firewall configuration
- 20.7 Firewall authenticator configuration
- 20.8 Access control configuration
- 20.9 Role hierarchy configuration
-
20. The security configuration
-
The Security Bridges
-
21. The Doctrine bridge
- 21.1 DoctrineTokenProvider
- 21.2 EntityUserProvider
-
22. The Propel1 bridge
- 22.1 EntityUserProvider
-
23. The Twig bridge
- 23.1 SecurityExtension
-
21. The Doctrine bridge
-
Recipes
- 24. Using recipes
- 25. Recipe 1: Creating an office hour voter
- 26. Recipe 2: Advanced switch user
- 27. Recipe 3: Permit only one user login
- 28. Recipe 4: Logging information about logins
- 29. Recipe 5: Two factor authentication
- 30. Recipe 6: Auto-login through URL
- 31. Recipe 7: Programmatically log in a user
- 32. Recipe 8: Authenticate users from subdomains
- 33. Recipe 9: Timeout user after failed login attempts
- Further reading
Authors have earned$8,690,825writing, publishing and selling on Leanpub,
earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
