Symfony Framework Deepdive - Security
Symfony Framework Deepdive - Security
A deepdive into the Symfony security component
About the Book
Many PHP developers are great specialists and know their way around PHP like the back of their hand. However, when a powerful framework like Symfony is built, it also includes software patterns and designs, which even the most experienced developers need to learn. This book is aimed to teach you exactly that.
The security component is the most complex and least known component of the whole Symfony2 infrastructure. This is mostly because all security work is accomplished by very flexible third party bundles. And, it is exactly this flexibility, which also makes the flow and processes within the component difficult to follow. Access managers, token providers, trust deciders, firewall maps, authorization listeners – these are just a few of the rarely heard of and even less understood inner workings of the security component, which are actually vital and very useful parts of it.
In this book, we'll dive into the security components (yes, there are actually more than one!) of the Symfony2 framework, along with the supporting bridges, to show you how all of the components fit and work together. Furthermore, you will learn about ALL of the configuration options of the security.yml file and how these options affect the security processes within Symfony. You will also learn how to implement the security component in a non-framework app or in your own custom framework.
Besides these internals, we will also go through some recipes to solve common problems, in order to give you a solid basis to solve your own.
About the Symfony Rainbow Series:The Symfony Rainbow Series is a collection of books, which describe, in detail, the different components that make up the Symfony framework. Every book will concentrate on a single component or a set of smaller components. The books will describe the component's inner workings and also give you recipes to solve common problems quickly and efficiently.
These books are intended for PHP developers with any level of knowledge of Symfony, from beginner to expert. They are especially made for those developers, who work with or want to work with Symfony and want to also do their programming with Symfony as smartly and efficiently as possible. If you would like to learn exactly how the inner workings of Symfony function together as a framework or how to use the wide range of Symfony components in a standalone fashion, then these books are for you!
About the Author
Bundles that include this book
Table of Contents
-
Introduction
- About the Symfony rainbow series
- About those who will read this book
- About those I’d like to thank
- About the security component
- 1. The big picture
-
The Security Core Component
-
2. The core component
- 2.1 Directory layout
-
3. Security context
- 3.1 The security context in Symfony 2.5
- 3.2 The security context in Symfony 2.6
-
4. Tokens
- 4.1 Token authentication
- 4.2 Different tokens
-
5. Managers, managers everywhere!
- 5.1 The access decision manager
- 5.2 The authentication manager
- 5.3 The authentication providers
-
6. Users and user providers
- 6.1 About users
- 6.2 Password encoders
- 6.3 Utilities
- 6.4 Validators
- 7. A complete implementation
-
2. The core component
-
The Security HTTP Component
-
8. The HTTP component
- 8.1 About the firewall
- 8.2 Directory layout
-
9. Components
- 9.1 Security listeners
- 9.2 Entry points
- 9.3 Rememember-me
- 9.4 Logout handlers
- 9.5 Session strategy
- 9.6 Authentication handlers
-
8. The HTTP component
-
The Security CSRF Component
- 10. Cross Site Request Forgery (CSRF)
-
11. The CSRF security component
- 11.1 Directory layout
- 11.2 Checking tokens
- 11.3 Creating tokens
-
The Security ACL Component
-
12. The ACL component
- 12.1 ACL terminology
- 12.2 Directory layout
-
13. Access Control Lists
- 13.1 How the ACL component works
-
14. Permissions
- 14.1 Storing permissions
- 14.2 Checking permissions
- 14.3 Setting multiple permissions
-
15. Advanced ACL techniques
- 15.1 Using parent ACLs
- 15.2 Using object fields
- 15.3 Class scope vs object scope
- 15.4 Creating custom permissions
- 15.5 Custom voters vs ACLs
- 15.6 ACL Auditing
-
16. Database storage
- 16.1 The ACL Schema
-
17. ACL internals
- 17.1 The ACL voter
- 17.2 The ACL provider
- 17.3 The lookupObjectIdentities method
- 17.4 The hydrateObjectIdentities method
- 17.5 The permissionGrantingStrategy
- 17.6 The isAceApplicable method
-
12. The ACL component
-
The Security Bundle
-
18. The glue that binds them
- 18.1 Directory layout
-
19. Building the service container
- 19.1 The SecurityBundle
- 19.2 The factories
- 19.3 The MainConfiguration
- 19.4 The SecurityExtension
-
18. The glue that binds them
-
The Security Configuration
-
20. The security configuration
- 20.1 Global configuration
- 20.2 Access decision manager configuration
- 20.3 ACL configuration
- 20.4 Encoders configuration
- 20.5 Provider configuration
- 20.6 Firewall configuration
- 20.7 Firewall authenticator configuration
- 20.8 Access control configuration
- 20.9 Role hierarchy configuration
-
20. The security configuration
-
The Security Bridges
-
21. The Doctrine bridge
- 21.1 DoctrineTokenProvider
- 21.2 EntityUserProvider
-
22. The Propel1 bridge
- 22.1 EntityUserProvider
-
23. The Twig bridge
- 23.1 SecurityExtension
-
21. The Doctrine bridge
-
Recipes
- 24. Using recipes
- 25. Recipe 1: Creating an office hour voter
- 26. Recipe 2: Advanced switch user
- 27. Recipe 3: Permit only one user login
- 28. Recipe 4: Logging information about logins
- 29. Recipe 5: Two factor authentication
- 30. Recipe 6: Auto-login through URL
- 31. Recipe 7: Programmatically log in a user
- 32. Recipe 8: Authenticate users from subdomains
- 33. Recipe 9: Timeout user after failed login attempts
- Further reading
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Do Well. Do Good.
Authors have earned$10,623,269writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
- #1
Jetpack Compose internals
Jorge CastilloJetpack Compose is the future of Android UI. Master how it works internally and become a more efficient developer with it. You'll also find it valuable if you are not an Android dev. This book provides all the details to understand how the Compose compiler & runtime work, and how to create a client library using them.
- #2
Functional Programming Made Easier
Charles ScalfaniA Functional Programming book from beginner to advanced without skipping a single step along the way.
In my 40 years of programming, I've felt that programming books always let me down, especially Functional Programming books. So, I wrote the book I wish I had 5 years ago.
Functional Programming will never be easy, but it can be easier.
- #3
Stratospheric
Tom Hombergs, Björn Wilmsmann, and Philip RiecksFrom Zero to Production with Spring Boot and AWS. All you need to know to get a Spring Boot application into production with AWS. No previous AWS knowledge required.
- #4
Thinking with Types
Sandy MaguireThis book aims to be the comprehensive manual for type-level programming. It's about getting you from here to there---from a competent Haskell programmer to one who convinces the compiler to do their work for them.
- #5
A Practical Guide to Testing in DevOps Japanese Edition
Katrina Clokie, Yuya Kazama, and Masanori KawaradaKatrina Clokieによる2017年8月発行の書籍『A Practical Guide to Testing in DevOps』の日本語翻訳版です。実装前や実装中でのテストだけでなく、本番環境でのテストについて、数多くの事例を用いて語られています。
- #6
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
- #7
Continuous Delivery Pipelines
Dave FarleyThis practical handbook provides a step-by-step guide for you to get the best continuous delivery pipeline for your software.
- #8
Practical FP in Scala: A hands-on approach
Gabriel VolpeA practical book aimed for those familiar with functional programming in Scala who are yet not confident about architecting an application from scratch.
Together, we will develop a purely functional application using the best libraries in the Cats ecosystem, while learning about design patterns and best practices.
- #9
Algebra-Driven Design
Sandy MaguireA how-to field guide on building leak-free abstractions and algebraically designing real-world applications.
- #10
The Python Journeyman
Robert Smallshire, Austin Bingham, and Sixty NorthOne of Python's strengths is that it's approachable and easy to learn, so that almost anyone can learn to write a basic Python program. The Python Journeyman will take you beyond that, beyond the basics. We will lead you through some of the deeper aspects of Python, and give you the skills you need to write great Python programs.
Top Bundles
- #1
CCIE Service Provider Ultimate Study Bundle
2 Books
Piotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification... - #2
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books
"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before... - #4
Retromat eBook Bundle for Agile Retrospectives
2 Books
If you facilitate retrospectives this bundle is for you: "Plans for Retrospectives" helps beginners learn the lay of the land with tried-and-true plans. Once you know your way around, "Run great agile retrospectives" contains all 135+ activities in Retromat for you to mix and match. - #6
9 Books-Bundle: Shut Up and Code!
9 Books
"Shut up and code." Laughter in the audience. The hacker had just plugged in his notebook and started sharing his screen to present his super-smart Python script. "Shut up and code" The letters written in a white literal coding font on black background was the hackers' home screen background mantra. At the time, I was a first-year computer... - #8
The Python Craftsman
3 Books
The Python Craftsman series comprises The Python Apprentice, The Python Journeyman, and The Python Master. The first book is primarily suitable for for programmers with some experience of programming in another language. If you don't have any experience with programming this book may be a bit daunting. You'll be learning not just a programming...
