PHPnews.io

New in Symfony 5.3: Improvements for Security Users

Written by Symfony blog / Original link on May. 3, 2021

Renamed User to InMemoryUser

6b6104be70a17b7121a278143053e433

Contributed by
Robin Chalas
in #40443.

In Symfony applications, the memory user provider allows to create users (and define their credentials) in a configuration file which is loaded in memory, without using databases or any other persisting service.

Although this user provider is only for prototypes or very small/special applications, it’s based on a class called User (the entire namespace is Symfony\Component\Security\Core\User\User). This confuses some newcomers, who think this is the main User class in Symfony security.

That’s why in Symfony 5.3 we’ve renamed User to InMemoryUser and UserChecker to InMemoryUserChecker to better convey their purpose (in 5.3 the old names still work but they are deprecated and in Symfony 6.0 they will be removed):

1
2
3
4
5
 # config/packages/security.yaml
 security:
     password_hashers:
-        Symfony\Component\Security\Core\User\User: bcrypt
+        Symfony\Component\Security\Core\User\InMemoryUser: bcrypt

Renamed username to identifier

331582449435f5efa35be870ab76f1a9

Contributed by
Wouter De Jong
in #40403.

Another source of confusion related to users is the concept of “username” which is used in the Symfony security. In many applications this username is not a traditional username, but an email or even some API token.

That’s why in Symfony 5.3 we’ve decided to avoid this confusion and we’ve renamed “username” to “user identifier”. This might require some changes in your application code (in 5.3 the old names still work but they are deprecated and in Symfony 6.0 they will be removed):

  • UserInterface::getUsername() is now UserInterface::getUserIdentifier()
  • loadUserByUsername() is now loadUserByUserIdentifier(), both in user loaders and user providers
  • UsernameNotFoundException is now UserNotFoundException

Decoupled Passwords from Users

6b6104be70a17b7121a278143053e433

Contributed by
Robin Chalas
in #40267.

The Symfony\Component\Security\Core\User\UserInterface is implemented by all the security users in Symfony applications. Sadly, this interface is a product of its time and it contains some methods that are no longer used in modern applications.

The first unneeded method is getSalt(), which is no longer necessary when using modern password hashing algorithms (bcrypt, Argon2, etc.) This method has been moved to a new LegacyPasswordAuthenticatedUserInterface.

The other method is getPassword() which is no longer needed in many password-less features, such as login links. This method has been moved to a new PasswordAuthenticatedUserInterface.

In Symfony 5.3, UserInterface still contains the getPassword() and getSalt() methods (they will be removed in Symfony 6.0). However, when upgrading to Symfony 5.3, you need to implement the new interfaces if you use those methods.

Sponsor the Symfony project.

symfony

« Back the func off, this is my abstraction! - ★ Exploring Event Sourcing (part 2) »