{"id":1116,"date":"2025-06-12T13:20:46","date_gmt":"2025-06-12T05:20:46","guid":{"rendered":"https:\/\/www.zhaozhao123.cn\/php\/php-application-manual\/symfony\/1116.html"},"modified":"2025-06-12T13:20:46","modified_gmt":"2025-06-12T05:20:46","slug":"%e5%9c%a8symfony%e4%b8%ad%e5%ae%9e%e6%96%bd%e6%8e%88%e6%9d%83%ef%bc%9a%e5%bc%80%e5%8f%91%e8%80%85%e6%8c%87%e5%8d%97","status":"publish","type":"my1js","link":"https:\/\/www.zhaozhao123.cn\/php\/my1js\/1116.html","title":{"rendered":"\u5728Symfony\u4e2d\u5b9e\u65bd\u6388\u6743\uff1a\u5f00\u53d1\u8005\u6307\u5357"},"content":{"rendered":"
\r\n
\r\n
\r\n
\r\n
\r\n
\"Bug编译狮\"<\/figure>\r\n\r\n\r\n\r\n

Bug编译狮<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
\r\n
\r\n

《在Symfony中实现授权：开发者指南》<\/p>\n

在现代Web开发中，安全性和权限控制是至关重要的。Symfony框架提供了强大的工具和模块来帮助开发者轻松地实现这些功能。以下是一些关键步骤和最佳实践，帮助你在Symfony项目中实施授权。<\/p>\n

1. 安装并配置GuardBundle<\/h3>\n

首先，你需要安装FOSUserBundle<\/code>和FOSGuardBundle<\/code>，这是Symfony Security的一部分。<\/p>\n

composer require friendsofsymfony\/user-bundle fos\/guard-bundle<\/code><\/pre>\n
然后，配置这两个Bundle：<\/p>\n
config\/bundles.php<\/code><\/h4>\n
return [\n    \/\/ 其他Bundle...\n\n    FOSUserBundleFOSUserBundle::class => ['all' => true],\n    FOSGuardBundleFOSGuardBundle::class => ['all' => true],\n];<\/code><\/pre>\n
config\/packages\/security.yaml<\/code><\/h4>\n
security:\n    encoders:\n        app_user: bcrypt\n\n    providers:\n        user_provider:\n            entity:\n                class: AppEntityUser\n                property: username\n\n    firewalls:\n        dev:\n            pattern: ^\/(_(dev|profiler|css|js)|assets)_\/\n            security: false\n\n        main:\n            anonymous: ~\n            guard:\n                authenticators:\n                    - AppSecurityAuthenticationFOSAuthenticator::class\n            logout:\n                path: \/logout\n            remember_me:\n                secret: 'your_secret_key'\n                lifetime: 604800 # 7 days in seconds\n                path: \/\n            form_login:\n                login_path: \/login\n                success_handler: AppControllerSecurityController::handleLoginSuccess\n                failure_handler: AppControllerSecurityController::handleLoginFailure\n                check_path: \/login_check\n                default_target_path: \/\n            logout_url: \/logout\n            access_control:\n                - { path: ^\/, roles: ROLE_USER }<\/code><\/pre>\n
2. 创建用户实体和角色<\/h3>\n
在src\/Entity<\/code>目录下创建用户实体类，并定义角色：<\/p>\n
\/\/ src\/Entity\/User.php\n\nuse DoctrineORMMapping as ORM;\nuse SymfonyComponentSecurityCoreUserUserInterface;\n\n\/**\n * @ORMEntity(repositoryClass=\"AppRepositoryUserRepository\")\n *\/\nclass User implements UserInterface\n{\n    \/**\n     * @ORMId\n     * @ORMGeneratedValue(strategy=\"AUTO\")\n     * @ORMColumn(type=\"integer\")\n     *\/\n    private $id;\n\n    \/**\n     * @ORMColumn(type=\"string\", length=180, unique=true)\n     *\/\n    private $username;\n\n    \/**\n     * @ORMColumn(type=\"string\", length=255)\n     *\/\n    private $email;\n\n    \/**\n     * @ORMColumn(type=\"boolean\")\n     *\/\n    private $enabled = true;\n\n    \/**\n     * @ORMColumn(type=\"json_array\")\n     *\/\n    private $roles = [];\n\n    \/\/ Getters and setters...\n}<\/code><\/pre>\n
3. 配置路由和控制器<\/h3>\n
创建登录和注销路由，并编写相应的控制器来处理这些请求：<\/p>\n
# config\/routes.yaml\n\napp_login:\n    path: \/login\n    methods: [GET, POST]\n    controller: AppControllerSecurityController::loginAction\n\napp_logout:\n    path: \/logout\n    methods: [POST]<\/code><\/pre>\n
\/\/ src\/Controller\/SecurityController.php\n\nnamespace AppController;\n\nuse SymfonyBundleFrameworkBundleControllerAbstractController;\nuse SymfonyComponentHttpFoundationRequest;\nuse SymfonyComponentRoutingAnnotationRoute;\nuse SymfonyComponentSecurityCoreEncoderUserPasswordEncoderInterface;\nuse SymfonyComponentSecurityCoreUserUserInterface;\nuse SymfonyComponentSecurityHttpAuthenticationTokenUsernamePasswordToken;\n\nclass SecurityController extends AbstractController\n{\n    private $passwordEncoder;\n\n    public function __construct(UserPasswordEncoderInterface $passwordEncoder)\n    {\n        $this->passwordEncoder = $passwordEncoder;\n    }\n\n    #[Route('\/login', name: 'app_login')]\n    public function loginAction(Request $request): Response\n    {\n        if ($this->isGranted('IS_AUTHENTICATED_FULLY')) {\n            return $this->redirectToRoute('target_route');\n        }\n\n        $authenticationUtils = $this->get('security.authentication_utils');\n\n        $error = $authenticationUtils->getLastAuthenticationError();\n        $lastUsername = $authenticationUtils->getLastUsername();\n\n        return $this->render('security\/login.html.twig', [\n            'last_username' => $lastUsername,\n            'error'         => $error,\n        ]);\n    }\n\n    #[Route('\/login_check', name: 'app_login_check')]\n    public function loginCheck(): void\n    {\n        throw new Exception('This is just a placeholder to prevent caching issues.');\n    }\n\n    #[Route('\/logout', name: 'app_logout')]\n    public function logoutAction(): void\n    {\n        \/\/ Perform any necessary actions before logging out\n        $this->authenticateUser(null);\n        $this->addFlash('notice', 'You have been logged out.');\n\n        return $this->redirectToRoute('homepage');\n    }\n\n    private function authenticateUser(?UserInterface $user): void\n    {\n        if (!$user) {\n            return;\n        }\n\n        $token = new UsernamePasswordToken($user, null, 'main', $user->getRoles());\n        $this->container->get('security.token_storage')->setToken($token);\n\n        if ($this->container->has('session')) {\n            $session = $this->container->get('session');\n            $session->set('_security_main', serialize($token));\n        }\n    }\n}<\/code><\/pre>\n
4. 实现认证逻辑<\/h3>\n
在src\/Security\/Authentication\/FOSAuthenticator.php<\/code>中实现认证逻辑：<\/p>\n
\/\/ src\/Security\/Authentication\/FOSAuthenticator.php\n\nnamespace AppSecurityAuthentication;\n\nuse FOSUserBundleModelUserInterface;\nuse SymfonyComponentHttpFoundationRequest;\nuse SymfonyComponentSecurityCoreAuthenticationSimpleFormAuthenticator;\nuse SymfonyComponentSecurityCoreExceptionAuthenticationException;\nuse SymfonyComponentSecurityCoreUserUserProviderInterface;\nuse SymfonyComponentHttpFoundationSessionSessionInterface;\n\nclass FOSAuthenticator extends SimpleFormAuthenticator\n{\n    private $userProvider;\n\n    public function __construct(UserProviderInterface $userProvider)\n    {\n        $this->userProvider = $userProvider;\n    }\n\n    protected function getCredentials(Request $request): array\n    {\n        return [\n            'username' => $request->get('username'),\n            'password' => $request->get('password'),\n        ];\n    }\n\n    protected function getUser($credentials, UserProviderInterface $userProvider): ?UserInterface\n    {\n        return $userProvider->loadUserByUsername($credentials['username']);\n    }\n\n    protected function checkCredentials($credentials, UserInterface $user): bool\n    {\n        return password_verify($credentials['password'], $user->getPassword());\n    }\n\n    protected function onAuthenticationSuccess(Request $request, UserInterface $user, string $firewallName): RedirectResponse\n    {\n        $session = $request->getSession();\n        if ($session !== null) {\n            $session->set('_security_' . $firewallName, serialize($this->createAuthenticatedToken($user, $firewallName)));\n        }\n\n        return new RedirectResponse($this->generateUrl('target_route'));\n    }\n\n    protected function onAuthenticationFailure(Request $request, AuthenticationException $exception): Response\n    {\n        return new RedirectResponse($this->generateUrl('app_login'), 302);\n    }\n\n    private function createAuthenticatedToken(UserInterface $user, string $firewallName): TokenInterface\n    {\n        $token = new UsernamePasswordToken($user, null, $firewallName, $user->getRoles());\n        $token->setAttributes(['authenticated' => true]);\n        return $token;\n    }\n}<\/code><\/pre>\n
5. 测试授权<\/h3>\n
最后，测试你的应用以确保授权功能正常工作。你可以通过访问不同的页面来验证用户是否能够访问受保护的内容。<\/p>\n
通过以上步骤，你可以在Symfony项目中成功实现基本的授权功能。随着项目的扩展，你还可以进一步探索更多的授权策略和功能，如角色继承、权限管理等。<\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>
\r\n
\r\n
\r\n
\r\n
\r\n
\"黑板Bug讲师\"<\/figure>\r\n\r\n\r\n\r\n
黑板Bug讲师<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
\r\n
\r\n
介绍<\/h3>
Symfony，一个强大的PHP框架，提供了一个全面的安全组件，使得开发者可以轻松处理应用程序的身份验证和授权问题。在这篇文章中，我们将详细介绍在Symfony项目中实现权限控制的过程。我们将探讨Symfony的授权系统，并提供实际代码示例以加深理解。<\/p>
理解Symfony Security<\/h3>
Symfony 安全组件分为两个主要部分：认证和授权。认证部分负责确认用户身份，而授权部分则授予已认证用户的权限。本指南将重点介绍授权部分，假设用户已经通过认证。<\/p>
Symfony的授权系统的核心组件包括“投票者”和“访问决策管理者”。投票者决定用户是否可以在资源上执行一个操作，而访问决策管理者则收集投票者的响应来做出最终的授权控制决策。<\/p>
配置访问控制<\/h3>
实施授权的第一步是在访问控制方面进行配置。security.yaml<\/code>文件。这是一份基本路线保护规则手册，简单明了。<\/p>
security:\n    access_control:\n        - { path: ^\/admin, roles: ROLE_ADMIN }\n        - { path: ^\/profile, roles: ROLE_USER }\n<\/code><\/pre>
该配置声明任何以…开头的路由都适用。\/admin<\/code>仅对具有“ROLE_ADMIN”角色的用户开放，以及以某些前缀开始的路由。\/profile<\/code>要求用户具有“ROLE_USER”角色。<\/p>
创建选民<\/h3>
为了进一步细化授权检查，我们需要创建选民。选民让您能够根据涉及资源或对象的更复杂的安全规则来决定。<\/p>
namespace AppSecurityVoter;\n\nuse SymfonyComponentSecurityCoreAuthorizationVoterVoter;\nuse SymfonyComponentSecurityCoreAuthenticationTokenTokenInterface;\n\nclass PostVoter extends Voter {\n    \/\/ Define your supported attributes and post instance check\n    protected function supports($attribute, $subject) {\n        if (!in_array($attribute, ['EDIT', 'DELETE'])) {\n            return false;\n        }\n\n        if (!$subject instanceof Post) {\n            return false;\n        }\n\n        return true;\n    }\n\n    \/\/ Voter logic implementation\n    protected function voteOnAttribute($attribute, $post, TokenInterface $token) {\n        $user = $token->getUser();\n\n        \/\/ Your custom logic to determine if the user can EDIT or DELETE the given Post instance\n        return $user === $post->getUser();\n    }\n}\n<\/code><\/pre>
在定义之后，我们接下来会做什么？supports<\/code>andvoteOnAttribute<\/code>在您的Voter类的方法中，您可以像以下方式在控制器操作中使用授权检查：<\/p>
public function editAction(Request $request, Post $post) {\n    $this->denyAccessUnlessGranted('EDIT', $post);\n\n    \/\/ ... edit post\n}\n<\/code><\/pre>
这。denyAccessUnlessGranted<\/code>该方法将与投票者进行交互，以确保当前用户有权编辑帖子。<\/p>
角色层级体系<\/h3>
Symfony 提供了一种简单的方法来定义您的角色层次结构。security.yaml<\/code>这种层级结构允许某些角色自动拥有其他角色的所有权限。<\/p>
security:\n    role_hierarchy:\n        ROLE_ADMIN: ROLE_USER\n        ROLE_SUPER_ADMIN: ROLE_ADMIN\n<\/code><\/pre>
这意味着拥有“ROLE_SUPER_ADMIN”角色的用户将自动获得“ROLE_ADMIN”和“ROLE_USER”的权限。<\/p>
保护服务<\/h3>
除了在控制器上控制访问，还可以通过使用安全表达式来直接定义服务的安全限制。<\/p>
services:\n    AppServiceAdminService:\n        \/\/ ... other configurations ...\n        arguments:\n            - '@security.authorization_checker'\n<\/code><\/pre>
然后，在服务类中，你可以调用。isGranted<\/code>在执行敏感操作之前，检查用户是否有适当的权限的方法。<\/p>
use SymfonyComponentSecurityCoreAuthorizationAuthorizationCheckerInterface;\n\nclass AdminService {\n    private $authorizationChecker;\n\n    public function __construct(AuthorizationCheckerInterface $authorizationChecker) {\n        $this->authorizationChecker = $authorizationChecker;\n    }\n\n    public function sensitiveAction() {\n        if (!$this->authorizationChecker->isGranted('ROLE_ADMIN')) {\n            throw new Exception('Access Denied.');\n        }\n\n        \/\/ Perform sensitive action\n    }\n}\n<\/code><\/pre>
因此，Symfony 的强大安全系统结合了投票者和访问控制规则，为开发者提供了实施有效且细致的访问管理所需的工具。<\/p>
最后的话<\/h3>
基于这个基础，你应该现在能够应对Symfony中的简单和复杂的授权方案。记住最佳的安全实践包括配置良好的系统和谨慎的编码习惯。始终进行定期的安全审计，并且在彻底测试后不要假设您的系统是安全的！<\/p><\/body>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>
\r\n
\r\n
\r\n
\r\n
\r\n
\"长工码奴1523\"<\/figure>\r\n\r\n\r\n\r\n
长工码奴1523<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
\r\n
\r\n
在 Symfony 中实现授权功能是一项重要的任务，这不仅有助于保护应用的安全性，还能提升用户体验。以下是一些基本的步骤和建议：<\/p>\n
1. 安装并配置 security.yml<\/code> 文件<\/h3>\n
首先，你需要创建一个 security.yml<\/code> 文件来定义身份验证和授权策略。<\/p>\n
# security.yml\nsecurity:\n    # ...\n    providers:\n        - class: AppSecurityCustomUserProvider\n          options:\n              email_field: 'email'\n              password_field: 'password'\n\n    firewalls:\n        - id: default\n          pattern: ^\/\n          form_login:\n              login_path: \/login\n              check_path: \/login_check\n          logout:\n              path:   \/logout\n              target: \/\n          anonymous: ~\n\n        - id: auth\n          pattern: ^\/api\/auth\n          form_login:\n              login_path: \/login\n              check_path: \/login_check\n          logout:\n              path:   \/logout\n              target: \/\n          anonymous: false\n\n    access_control:\n        - { path: ^\/api, roles: IS_AUTHENTICATED_ANONYMOUSLY }<\/code><\/pre>\n
2. 创建自定义用户提供商<\/h3>\n
在 Symfony 中，你可以使用 AppSecurityCustomUserProvider<\/code> 来实现自定义用户验证策略。这个类会处理用户的登录和认证过程，并将数据存储到数据库或其他持久化存储中。<\/p>\n
<?php\n\nnamespace AppSecurity;\n\nuse SymfonyComponentSecurityCoreUserUserInterface;\nuse SymfonyComponentSecurityCoreUserUserProviderInterface;\nuse SymfonyComponentSecurityCoreExceptionUsernameNotFoundException;\nuse SymfonyComponentSecurityCoreExceptionBadCredentialsException;\n\nclass CustomUserProvider implements UserProviderInterface\n{\n    public function loadUserByUsername($username)\n    {\n        \/\/ 在这里实现逻辑，例如检查用户名是否存在，密码是否正确等。\n        \/\/ 这里假设有一个方法可以获取用户信息。\n        $userRepository = new UserRepository();\n        $user = $userRepository->findByEmail($username);\n\n        if (!$user) {\n            throw new UsernameNotFoundException('User not found');\n        }\n\n        return $user;\n    }\n\n    public function supportsClass($class)\n    {\n        return $class === AppEntityUser::class;\n    }\n}<\/code><\/pre>\n
3. 实现身份验证与授权规则<\/h3>\n
接下来，需要根据业务需求设置身份验证和授权规则。这通常涉及到设置路由权限和控制访问。<\/p>\n
# routes.yaml\nrouter:\n    resources:\n        - :api\n        - :auth<\/code><\/pre>\n
在这些路由上，可以根据需要添加不同的权限控制。<\/p>\n
# api.yaml\napi:\n    security:\n        access_control:\n            - { path: ^\/api\/auth, roles: IS_AUTHENTICATED_ANONYMOUSLY }<\/code><\/pre>\n
4. 使用 @SecurityGuard<\/code> 注解<\/h3>\n
为了确保用户通过了安全验证，可以在控制器中添加 @SecurityGuard<\/code> 注解来触发安全检查。<\/p>\n
<?php\n\nnamespace AppController;\n\nuse SymfonyBundleFrameworkBundleControllerAbstractController;\nuse SymfonyComponentHttpFoundationResponse;\nuse SymfonyComponentRoutingAnnotationRoute;\n\nclass AuthController extends AbstractController\n{\n    \/**\n     * @Route(\"\/api\/auth\", name=\"api_auth\")\n     *\/\n    public function authenticate(): Response\n    {\n        \/\/ 检查用户是否已登录\n        if ($this->isGranted(\"IS_AUTHENTICATED_ANONYMOUSLY\")) {\n            return new Response(\"You are already authenticated as an anonymous user.\");\n        } else {\n            \/\/ 如果不是匿名用户，则跳转至登录页面\n            return $this->redirectToRoute(\"app_login\");\n        }\n    }\n}<\/code><\/pre>\n
示例代码<\/h3>\n
以下是一个简单的示例代码片段，展示了如何在 Symfony 应用程序中使用自定义用户验证策略：<\/p>\n
<?php\n\nnamespace AppSecurity;\n\nuse SymfonyComponentSecurityCoreUserUserInterface;\nuse SymfonyComponentSecurityCoreUserUserProviderInterface;\nuse SymfonyComponentSecurityCoreExceptionUsernameNotFoundException;\nuse SymfonyComponentSecurityCoreExceptionBadCredentialsException;\n\nclass CustomUserProvider implements UserProviderInterface\n{\n    private $userRepository;\n\n    public function __construct(UserRepository $userRepository)\n    {\n        $this->userRepository = $userRepository;\n    }\n\n    public function loadUserByUsername($username)\n    {\n        $user = $this->userRepository->findOneBy(['email' => $username]);\n\n        if (!$user) {\n            throw new UsernameNotFoundException('User not found');\n        }\n\n        return $user;\n    }\n\n    public function supportsClass($class)\n    {\n        return $class === AppEntityUser::class;\n    }\n}<\/code><\/pre>\n
总结<\/h3>\n
通过以上步骤，你可以为 Symfony 应用程序中的资源提供身份验证和授权服务。注意，实际应用中还需要考虑更复杂的情况，如缓存机制、用户管理、错误处理等。希望这能帮助你在 Symfony 开发过程中实现有效的身份验证和授权解决方案。<\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Bug编译狮 《在Symfony中实现授权：开发者指南》 在&#29..<\/p>\n","protected":false},"author":1,"featured_media":0,"menu_order":0,"template":"","meta":{"_acf_changed":false},"tags":[],"my1js2nav":[45],"tuisongtax":[],"class_list":["post-1116","my1js","type-my1js","status-publish","hentry","my1js2nav-symfony"],"acf":{"qian_art_seotitle":"","qian_art_seotitle_source":{"label":"SEO\u6807\u9898","type":"text","formatted_value":""},"qian_art_seokws":"","qian_art_seokws_source":{"label":"SEO\u5173\u952e\u8bcd","type":"text","formatted_value":""},"qian_art_stzhong":"","qian_art_stzhong_source":{"label":"\u4e2d | \u77ed\u6807\u9898","type":"text","formatted_value":""}},"_links":{"self":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js\/1116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js"}],"about":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/types\/my1js"}],"author":[{"embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/media?parent=1116"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/tags?post=1116"},{"taxonomy":"my1js2nav","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js2nav?post=1116"},{"taxonomy":"tuisongtax","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/tuisongtax?post=1116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}