Symfony Framework Deepdive - Security
Symfony Framework Deepdive - Security
A deepdive into the Symfony security component
About the Book
Many PHP developers are great specialists and know their way around PHP like the back of their hand. However, when a powerful framework like Symfony is built, it also includes software patterns and designs, which even the most experienced developers need to learn. This book is aimed to teach you exactly that.
The security component is the most complex and least known component of the whole Symfony2 infrastructure. This is mostly because all security work is accomplished by very flexible third party bundles. And, it is exactly this flexibility, which also makes the flow and processes within the component difficult to follow. Access managers, token providers, trust deciders, firewall maps, authorization listeners – these are just a few of the rarely heard of and even less understood inner workings of the security component, which are actually vital and very useful parts of it.
In this book, we'll dive into the security components (yes, there are actually more than one!) of the Symfony2 framework, along with the supporting bridges, to show you how all of the components fit and work together. Furthermore, you will learn about ALL of the configuration options of the security.yml file and how these options affect the security processes within Symfony. You will also learn how to implement the security component in a non-framework app or in your own custom framework.
Besides these internals, we will also go through some recipes to solve common problems, in order to give you a solid basis to solve your own.About the Symfony Rainbow Series:
The Symfony Rainbow Series is a collection of books, which describe, in detail, the different components that make up the Symfony framework. Every book will concentrate on a single component or a set of smaller components. The books will describe the component's inner workings and also give you recipes to solve common problems quickly and efficiently.
These books are intended for PHP developers with any level of knowledge of Symfony, from beginner to expert. They are especially made for those developers, who work with or want to work with Symfony and want to also do their programming with Symfony as smartly and efficiently as possible. If you would like to learn exactly how the inner workings of Symfony function together as a framework or how to use the wide range of Symfony components in a standalone fashion, then these books are for you!
- About the Symfony rainbow series
- About those who will read this book
- About those I’d like to thank
- About the security component
- 1. The big picture
The Security Core Component
2. The core component
- 2.1 Directory layout
3. Security context
- 3.1 The security context in Symfony 2.5
- 3.2 The security context in Symfony 2.6
- 4.1 Token authentication
- 4.2 Different tokens
5. Managers, managers everywhere!
- 5.1 The access decision manager
- 5.2 The authentication manager
- 5.3 The authentication providers
6. Users and user providers
- 6.1 About users
- 6.2 Password encoders
- 6.3 Utilities
- 6.4 Validators
- 7. A complete implementation
- 2. The core component
The Security HTTP Component
8. The HTTP component
- 8.1 About the firewall
- 8.2 Directory layout
- 9.1 Security listeners
- 9.2 Entry points
- 9.3 Rememember-me
- 9.4 Logout handlers
- 9.5 Session strategy
- 9.6 Authentication handlers
- 8. The HTTP component
The Security CSRF Component
- 10. Cross Site Request Forgery (CSRF)
11. The CSRF security component
- 11.1 Directory layout
- 11.2 Checking tokens
- 11.3 Creating tokens
The Security ACL Component
12. The ACL component
- 12.1 ACL terminology
- 12.2 Directory layout
13. Access Control Lists
- 13.1 How the ACL component works
- 14.1 Storing permissions
- 14.2 Checking permissions
- 14.3 Setting multiple permissions
15. Advanced ACL techniques
- 15.1 Using parent ACLs
- 15.2 Using object fields
- 15.3 Class scope vs object scope
- 15.4 Creating custom permissions
- 15.5 Custom voters vs ACLs
- 15.6 ACL Auditing
16. Database storage
- 16.1 The ACL Schema
17. ACL internals
- 17.1 The ACL voter
- 17.2 The ACL provider
- 17.3 The lookupObjectIdentities method
- 17.4 The hydrateObjectIdentities method
- 17.5 The permissionGrantingStrategy
- 17.6 The isAceApplicable method
- 12. The ACL component
The Security Bundle
18. The glue that binds them
- 18.1 Directory layout
19. Building the service container
- 19.1 The SecurityBundle
- 19.2 The factories
- 19.3 The MainConfiguration
- 19.4 The SecurityExtension
- 18. The glue that binds them
The Security Configuration
20. The security configuration
- 20.1 Global configuration
- 20.2 Access decision manager configuration
- 20.3 ACL configuration
- 20.4 Encoders configuration
- 20.5 Provider configuration
- 20.6 Firewall configuration
- 20.7 Firewall authenticator configuration
- 20.8 Access control configuration
- 20.9 Role hierarchy configuration
- 20. The security configuration
The Security Bridges
21. The Doctrine bridge
- 21.1 DoctrineTokenProvider
- 21.2 EntityUserProvider
22. The Propel1 bridge
- 22.1 EntityUserProvider
23. The Twig bridge
- 23.1 SecurityExtension
- 21. The Doctrine bridge
- 24. Using recipes
- 25. Recipe 1: Creating an office hour voter
- 26. Recipe 2: Advanced switch user
- 27. Recipe 3: Permit only one user login
- 28. Recipe 4: Logging information about logins
- 29. Recipe 5: Two factor authentication
- 30. Recipe 6: Auto-login through URL
- 31. Recipe 7: Programmatically log in a user
- 32. Recipe 8: Authenticate users from subdomains
- 33. Recipe 9: Timeout user after failed login attempts
- Further reading
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
C++ Best PracticesJason Turner
Level up your C++, get the tools working for you, eliminate common problems, and move on to more exciting things!
OpenIntro StatisticsDavid Diez, Christopher Barr, Mine Cetinkaya-Rundel, and OpenIntro
A complete foundation for Statistics, also serving as a foundation for Data Science.
Leanpub revenue supports OpenIntro (US-based nonprofit) so we can provide free desk copies to teachers interested in using OpenIntro Statistics in the classroom and expand the project to support free textbooks in other subjects.
More resources: openintro.org.
Functional Design and ArchitectureAlexander Granin
Software Design in Functional Programming, Design Patterns and Practices, Methodologies and Application Architectures. How to build real software in Haskell with less efforts and low risks. The first complete source of knowledge.
Atomic KotlinBruce Eckel and Svetlana Isakova
For both beginning and experienced programmers! From the author of the multi-award-winning Thinking in C++ and Thinking in Java together with a member of the Kotlin language team comes a book that breaks the concepts into small, easy-to-digest "atoms," along with exercises supported by hints and solutions directly inside IntelliJ IDEA!
C++20 is the next big C++ standard after C++11. As C++11 did it, C++20 changes the way we program modern C++. This change is, in particular, due to the big four of C++20: ranges, coroutines, concepts, and modules.
The book is almost daily updated. These incremental updates ease my interaction with the proofreaders.
Introductory Statistics with Randomization and SimulationMine Cetinkaya-Rundel, Christopher Barr, OpenIntro, and David Diez
A complete foundation for Statistics, also serving as a foundation for Data Science, that introduces inference using randomization and simulation while covering traditional methods.
Leanpub revenue supports OpenIntro, so we can provide free desk copies to teachers interested in using our books in the classroom.
More resources: openintro.org.
Java OOP Done RightAlan Mellor
Object Oriented Programming is still a great way to create clean, maintainable code. But only if you use it right.
This book gives you 25 years of OO best practice, ready to use.
You'll learn to design objects behaviour-first, use TDD to help, then confidently apply Design Patterns, SOLID principles and Refactoring to make clean, crafted code.
Ansible for DevOpsJeff Geerling
Ansible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
Composing SoftwareEric Elliott
All software design is composition: the act of breaking complex problems down into smaller problems and composing those solutions. Most developers have a limited understanding of compositional techniques. It's time for that to change.
Cloud StrategyGregor Hohpe
“Strategy is the difference between making a wish and making it come true.” A successful migration to the cloud shouldn’t be driven by wishes, but guided by a sound strategy, frameworks, and decision models. This book tells you how—without becoming superficial nor getting lost in technology and product details.
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before...
CCIE Service Provider Ultimate Study Bundle
2 BooksPiotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification...
Cisco CCNA 200-301 Complet
4 BooksCe lot comprend les quatre volumes du guide préparation à l'examen de certification Cisco CCNA 200-301.
CCDE Practical Studies (All labs)
3 BooksCCDE lab
Modern Management Made Easy
3 BooksRead all three Modern Management Made Easy books. Learn to manage yourself, lead and serve others, and lead the organization.
The Future of Digital Health
6 BooksWe put together the most popular books from The Medical Futurist to provide a clear picture about the major trends shaping the future of medicine and healthcare. Digital health technologies, artificial intelligence, the future of 20 medical specialties, big pharma, data privacy and how technology giants such as Amazon or Google want to conquer...
Modern C++ by Nicolai Josuttis
Django for Beginners/APIs/Professionals
"The C++ Standard Library" and "Concurrency with Modern C++"
2 BooksGet my books "The C++ Standard Library" and "Concurrency with Modern C++" in a bundle. The first book gives you the details you should know about the C++ standard library; the second one dives deeper into concurrency with modern C++. In sum, you get more than 600 pages full of modern C++ and about 250 source files presenting the standard library...
Linux Administration Complet
4 BooksCe lot comprend les quatre volumes du Guide Linux Administration :Linux Administration, Volume 1, Administration fondamentale : Guide pratique de préparation aux examens de certification LPIC 1, Linux Essentials, RHCSA et LFCS. Administration fondamentale. Introduction à Linux. Le Shell. Traitement du texte. Arborescence de fichiers. Sécurité...