New in Symfony 5.3: Improvements for Security Users
Warning: This post is about an unsupported Symfony version. Some of this information may be out of date. Read the most recent Symfony Docs.
In Symfony applications, the memory user provider allows to create users (and define their credentials) in a configuration file which is loaded in memory, without using databases or any other persisting service.
Although this user provider is only for prototypes or very small/special
applications, it's based on a class called
User (the entire namespace is
Symfony). This confuses some newcomers,
who think this is the main
User class in Symfony security.
That's why in Symfony 5.3 we've renamed
InMemoryUserChecker to better convey their purpose
(in 5.3 the old names still work but they are deprecated and in Symfony 6.0
they will be removed):
1 2 3 4 5
# config/packages/security.yaml security: password_hashers: - Symfony\Component\Security\Core\User\User: bcrypt + Symfony\Component\Security\Core\User\InMemoryUser: bcrypt
Another source of confusion related to users is the concept of "username" which is used in the Symfony security. In many applications this username is not a traditional username, but an email or even some API token.
That's why in Symfony 5.3 we've decided to avoid this confusion and we've renamed "username" to "user identifier". This might require some changes in your application code (in 5.3 the old names still work but they are deprecated and in Symfony 6.0 they will be removed):
loadUserByUserIdentifier(), both in user loaders and user providers
Symfony is implemented by all
the security users in Symfony applications. Sadly, this interface is a product
of its time and it contains some methods that are no longer used in modern applications.
The first unneeded method is
getSalt(), which is no longer necessary when
using modern password hashing algorithms (bcrypt, Argon2, etc.) This method has
been moved to a new
The other method is
getPassword() which is no longer needed in many
password-less features, such as login links. This method has been moved to a
In Symfony 5.3,
UserInterface still contains the
getSalt() methods (they will be removed in Symfony 6.0). However, when
upgrading to Symfony 5.3, you need to implement the new interfaces if you use
Comments are closed.
To ensure that comments stay relevant, they are closed for old posts.