symfony/security-http
Security Http
This project provides a comprehensive security framework for PHP applications, designed to manage the entire lifecycle of user authentication and authorization. It functions as a middleware layer that intercepts incoming HTTP requests to enforce security policies, resolve user identities, and maintain persistent sessions across web interactions.
The framework distinguishes itself through a modular, event-driven architecture that integrates directly into the application lifecycle. It supports diverse authentication methods, including standard form-based logins, API bearer tokens, and federated identity integration via OpenID Connect and OAuth. Authorization is handled through a flexible system that combines role-based access control with attribute-driven metadata, allowing developers to define granular permissions and custom logic directly on controller methods.
Beyond core identity management, the library includes protective utilities to mitigate common web vulnerabilities. It provides built-in mechanisms for cross-site request forgery protection, login rate limiting to prevent brute-force attacks, and secure session termination directives. The framework also facilitates automated security auditing by scanning project dependencies for known vulnerabilities.
Features
- Authentication Frameworks - Serves as a comprehensive PHP framework for managing user authentication, session lifecycles, and access control across web applications.
- User Authentication Systems - Provides a comprehensive framework for verifying visitor credentials and establishing secure sessions.
- Bearer Token Authentication - Validates incoming requests by extracting and verifying bearer tokens from headers or request bodies.
- Route-Based - Configures firewalls to intercept incoming HTTP requests and enforce security policies across specific routes.
- Role-Based Access Control - Enforces authorization rules based on user roles, supporting hierarchical structures and granular checks.
- Backend Security Middleware - Functions as a middleware layer that intercepts incoming HTTP requests to enforce security policies and restrict access to application routes.
- Web Application Security - Implements a comprehensive security framework for web applications, managing authentication, session persistence, and request interception.
- Firewall Interceptors - Intercepts incoming HTTP traffic at the application entry point to enforce security policies and route requests.
- Authenticated User Injection - Resolves the currently authenticated user object from the security context and passes it into controller methods.
- Dependency-Injected Contexts - Simplifies access to authenticated user data by injecting the security context directly into controller methods.
- Attribute-Based Access Control - Enforces granular authorization rules on controller methods using declarative metadata attributes.
- Brute Force Protections - Provides built-in rate-limiting mechanisms to throttle login attempts and prevent brute-force attacks on application endpoints.
- Authentication Rate Limiters - Limits the frequency of login attempts to prevent brute-force attacks against user accounts.
- Cross-Site Request Forgery Protections - Protects against cross-site request forgery by verifying security tokens provided in headers, query strings, or request bodies.
- Custom Authorization Logic - Defines complex business logic for access control by creating custom evaluators beyond simple role-based rules.
- OIDC Identity Integrations - Verifies external identity tokens by checking digital signatures and claims to authenticate users through third-party providers.
- Password Hashing Utilities - Secures user credentials by hashing passwords before storage and verifying them during login attempts.
- Session Cookie Authentications - Maintains user authentication across browser sessions by managing secure cookies and user identifiers.
- Third-Party Identity Integrations - Supports federated identity integration via OpenID Connect and OAuth to authenticate users through external providers.
- Session Token Persisters - Maintains user sessions by serializing and deserializing security tokens across multiple web requests.
- User Providers - Abstracts the retrieval of user identity objects from various storage backends.
- User Identity Management - Loads and refreshes user objects from storage providers to ensure session data remains synchronized.
- Authentication Event Hooks - Processes authentication through a chain of event-driven listeners during the request lifecycle.
