Symfony Framework Deepdive - Security
This book is 100% complete
Completed on 2015-02-03
About the Book
Many PHP developers are great specialists and know their way around PHP like the back of their hand. However, when a powerful framework like Symfony is built, it also includes software patterns and designs, which even the most experienced developers need to learn. This book is aimed to teach you exactly that.
The security component is the most complex and least known component of the whole Symfony2 infrastructure. This is mostly because all security work is accomplished by very flexible third party bundles. And, it is exactly this flexibility, which also makes the flow and processes within the component difficult to follow. Access managers, token providers, trust deciders, firewall maps, authorization listeners – these are just a few of the rarely heard of and even less understood inner workings of the security component, which are actually vital and very useful parts of it.
In this book, we'll dive into the security components (yes, there are actually more than one!) of the Symfony2 framework, along with the supporting bridges, to show you how all of the components fit and work together. Furthermore, you will learn about ALL of the configuration options of the security.yml file and how these options affect the security processes within Symfony. You will also learn how to implement the security component in a non-framework app or in your own custom framework.
Besides these internals, we will also go through some recipes to solve common problems, in order to give you a solid basis to solve your own.
About the Symfony Rainbow Series:The Symfony Rainbow Series is a collection of books, which describe, in detail, the different components that make up the Symfony framework. Every book will concentrate on a single component or a set of smaller components. The books will describe the component's inner workings and also give you recipes to solve common problems quickly and efficiently.
These books are intended for PHP developers with any level of knowledge of Symfony, from beginner to expert. They are especially made for those developers, who work with or want to work with Symfony and want to also do their programming with Symfony as smartly and efficiently as possible. If you would like to learn exactly how the inner workings of Symfony function together as a framework or how to use the wide range of Symfony components in a standalone fashion, then these books are for you!
Table of Contents
-
Introduction
- About the Symfony rainbow series
- About those who will read this book
- About those I’d like to thank
- About the security component
- 1. The big picture
-
The Security Core Component
-
2. The core component
- 2.1 Directory layout
-
3. Security context
- 3.1 The security context in Symfony 2.5
- 3.2 The security context in Symfony 2.6
-
4. Tokens
- 4.1 Token authentication
- 4.2 Different tokens
-
5. Managers, managers everywhere!
- 5.1 The access decision manager
- 5.2 The authentication manager
- 5.3 The authentication providers
-
6. Users and user providers
- 6.1 About users
- 6.2 Password encoders
- 6.3 Utilities
- 6.4 Validators
- 7. A complete implementation
-
2. The core component
-
The Security HTTP Component
-
8. The HTTP component
- 8.1 About the firewall
- 8.2 Directory layout
-
9. Components
- 9.1 Security listeners
- 9.2 Entry points
- 9.3 Rememember-me
- 9.4 Logout handlers
- 9.5 Session strategy
- 9.6 Authentication handlers
-
8. The HTTP component
-
The Security CSRF Component
- 10. Cross Site Request Forgery (CSRF)
-
11. The CSRF security component
- 11.1 Directory layout
- 11.2 Checking tokens
- 11.3 Creating tokens
-
The Security ACL Component
-
12. The ACL component
- 12.1 ACL terminology
- 12.2 Directory layout
-
13. Access Control Lists
- 13.1 How the ACL component works
-
14. Permissions
- 14.1 Storing permissions
- 14.2 Checking permissions
- 14.3 Setting multiple permissions
-
15. Advanced ACL techniques
- 15.1 Using parent ACLs
- 15.2 Using object fields
- 15.3 Class scope vs object scope
- 15.4 Creating custom permissions
- 15.5 Custom voters vs ACLs
- 15.6 ACL Auditing
-
16. Database storage
- 16.1 The ACL Schema
-
17. ACL internals
- 17.1 The ACL voter
- 17.2 The ACL provider
- 17.3 The lookupObjectIdentities method
- 17.4 The hydrateObjectIdentities method
- 17.5 The permissionGrantingStrategy
- 17.6 The isAceApplicable method
-
12. The ACL component
-
The Security Bundle
-
18. The glue that binds them
- 18.1 Directory layout
-
19. Building the service container
- 19.1 The SecurityBundle
- 19.2 The factories
- 19.3 The MainConfiguration
- 19.4 The SecurityExtension
-
18. The glue that binds them
-
The Security Configuration
-
20. The security configuration
- 20.1 Global configuration
- 20.2 Access decision manager configuration
- 20.3 ACL configuration
- 20.4 Encoders configuration
- 20.5 Provider configuration
- 20.6 Firewall configuration
- 20.7 Firewall authenticator configuration
- 20.8 Access control configuration
- 20.9 Role hierarchy configuration
-
20. The security configuration
-
The Security Bridges
-
21. The Doctrine bridge
- 21.1 DoctrineTokenProvider
- 21.2 EntityUserProvider
-
22. The Propel1 bridge
- 22.1 EntityUserProvider
-
23. The Twig bridge
- 23.1 SecurityExtension
-
21. The Doctrine bridge
-
Recipes
- 24. Using recipes
- 25. Recipe 1: Creating an office hour voter
- 26. Recipe 2: Advanced switch user
- 27. Recipe 3: Permit only one user login
- 28. Recipe 4: Logging information about logins
- 29. Recipe 5: Two factor authentication
- 30. Recipe 6: Auto-login through URL
- 31. Recipe 7: Programmatically log in a user
- 32. Recipe 8: Authenticate users from subdomains
- 33. Recipe 9: Timeout user after failed login attempts
- Further reading
Bundles that include this book
About the Author
Joshua Thijssen is a freelance consultant and trainer. His daily work consists of maintaining code bases, working on different projects and helping other to achieve higher standards in both coding and thinking. He is the author of the PHP|Architect book "Mastering the SPL library", founder of the Dutch Web Alliance and regular speaker at national and international conferences.
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms...
