New in Symfony 6.4: Security Improvements
November 21, 2023 • Published by Javier Eguiluz
Symfony 6.4 is backed by:
Badge Resolution in the Profiler
Contributed by
Hubert Lenoir
in #51585.
The Symfony Profiler provides detailed information about the security such as the user token details, the security listeners related to the request and the access decision log.
In Symfony 6.4 we're improving it to also display how the security badges are
resolved. In this example, the user input their credentials wrong, so the
PasswordCredentials
badge is not resolved correctly:
In this other example, user authentication was successful:
Safer Security Logs
Contributed by
Florent Morselli
in #51434.
When using the login throttling in your application (via the RateLimiter component) Symfony generates certain log messages. Those logs include information such as the IP address the username. These could be considered as PII (Personally Identifiable Information) and that's why we're hashing them with a cryptographically secure hash function.
You only need to upgrade to Symfony 6.4 or higher and Symfony will start hashing the IP address and the username using the kernel secret of your application.
Arrays of Patterns in Firewalls
Contributed by
Grégoire Pineau
in #51128.
The pattern
option of the security firewall defines the regular expression
used to decide if the incoming request matches the firewall. Sometimes, a single
firewall matches multiple paths, which can make the regular expression hard to
maintain. In Symfony 6.4, we're improving this option so you can also pass
an array of regular expressions:
1 2 3 4 5 6 7 8
# config/packages/security.html.twig
security:
firewalls:
no_security:
- pattern: "^/(register|documentation)$"
+ pattern:
+ - "^/register$"
+ - "^/documentation$"
Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.
Comments are closed.
To ensure that comments stay relevant, they are closed for old posts.
Those logs include information such as the IP address the the username. => Those logs include information such as the IP address and the username.
These could be considered as PII (Personally Identifiable Information) ad that's why we're hashing them with a cryptographic secure hash function. => These could be considered as PII (Personally Identifiable Information) and that’s why we’re hashing them with a secure cryptographic hash function.
I think, Philippe meant those typos: One missing "and" and an "and" instead of "ad" in the following sentence.