New in Symfony 8.2 Firewalls and Routes

Selecting the Firewall in the Route

Contributed by tilaven in #63112

Symfony selects the firewall of a request by checking the pattern or the request_matcher of each firewall in the security.firewalls configuration. This keeps the routes and their authentication apart, which is inconvenient in modular applications where each module defines its own routes. In Symfony 8.2, routes can define the firewall that handles them using the new firewall option:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

// src/Controller/OrderController.php
namespace App\Controller;

use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;

class OrderController
{
    #[Route('/api/orders', name: 'api_orders', firewall: 'api_jwt')]
    public function orders(): Response
    {
        // ...
    }
}

1
2
3
4
5

# config/routes.yaml
api_orders:
    path: /api/orders
    controller: App\Controller\OrderController::orders
    firewall: api_jwt

1
2
3
4
5
6
7
8
9

// config/routes.php
use App\Controller\OrderController;
use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;

return function (RoutingConfigurator $routes): void {
    $routes->add('api_orders', '/api/orders')
        ->controller([OrderController::class, 'orders'])
        ->firewall('api_jwt');
};

The given firewall is used instead of the ones matching the request, and routes that don't define this option work as before. If the firewall doesn't exist, Symfony throws an exception instead of falling back to another firewall.

The firewall option only changes how users are authenticated: your access_control rules still apply as usual, regardless of the firewall that handled the request. To check the firewall of a route, run the debug:router command, which displays it as the _firewall route default.

Loading the Routes of All Firewalls

Contributed by Nicolas Grekas in #66881

Some firewall features need routes to work, like the logout path or the OpenID Connect callback. Symfony generates these routes from your security configuration, but your application must import the service that loads them. Until now, this meant importing security.route_loader.logout, and features like OpenID Connect login added in Symfony 8.2 also need their own routes.

Symfony 8.2 adds a security.route_loader service that loads the routes of all firewalls, so your application only needs one import. The security.route_loader.logout service is deprecated and will be removed in Symfony 9.0, so update your configuration as follows:

1
2
3
4
5
6

# config/routes/security.yaml
-_security_logout:
-    resource: security.route_loader.logout
+_security:
+    resource: security.route_loader
     type: service

Redirecting Anonymous Users Without an Entry Point Class

Contributed by Damian D'amico in #67140

Some authenticators, like json_login and many custom ones, don't redirect anonymous users to a login page. Until now, doing that required creating a class that implements AuthenticationEntryPointInterface just to return a redirect. In Symfony 8.2, use the new entry_point_path firewall option instead:

1
2
3
4
5
6
7

# config/packages/security.yaml
security:
    firewalls:
        main:
            json_login:
                check_path: api_login
            entry_point_path: app_login

1
2
3
4
5
6
7
8
9
10
11
12
13

// config/packages/security.php
namespace Symfony\Component\DependencyInjection\Loader\Configurator;

return App::config([
    'security' => [
        'firewalls' => [
            'main' => [
                'json_login' => ['check_path' => 'api_login'],
                'entry_point_path' => 'app_login',
            ],
        ],
    ],
]);

Like the login_path option, its value can be a path, an absolute URL or a route name. In stateful firewalls, Symfony also saves the requested URL so users can return to it after logging in. This option can't be combined with the entry_point option in the same firewall.