Skip to content
  • About
    • What is Symfony?
    • Community
    • News
    • Contributing
    • Support
  • Documentation
    • Symfony Docs
    • Symfony Book
    • Screencasts
    • Symfony Bundles
    • Symfony Cloud
    • Training
  • Services
    • Platform.sh for Symfony Best platform to deploy Symfony apps
    • SymfonyInsight Automatic quality checks for your apps
    • Symfony Certification Prove your knowledge and boost your career
    • SensioLabs Professional services to help you with Symfony
    • Blackfire Profile and monitor performance of your apps
  • Other
  • Blog
  • Download
sponsored by SensioLabs
  1. Home
  2. Documentation
  3. Security
  4. Security: Complex Access Controls with Expressions
  • Documentation
  • Book
  • Reference
  • Bundles
  • Cloud
  • Learn more

Security: Complex Access Controls with Expressions

Edit this page

Warning: You are browsing the documentation for Symfony 3.3, which is no longer maintained.

Read the updated version of this page for Symfony 6.3 (the current stable version).

Security: Complex Access Controls with Expressions

See also

The best solution for handling complex authorization rules is to use the Voter System.

In addition to a role like ROLE_ADMIN, the isGranted() method also accepts an Expression object:

1
2
3
4
5
6
7
8
9
10
11
use Symfony\Component\ExpressionLanguage\Expression;
// ...

public function indexAction()
{
    $this->denyAccessUnlessGranted(new Expression(
        '"ROLE_ADMIN" in roles or (user and user.isSuperAdmin())'
    ));

    // ...
}

In this example, if the current user has ROLE_ADMIN or if the current user object's isSuperAdmin() method returns true, then access will be granted (note: your User object may not have an isSuperAdmin() method, that method is invented for this example).

This uses an expression and you can learn more about the expression language syntax, see The Expression Syntax.

Inside the expression, you have access to a number of variables:

user
The user object (or the string anon if you're not authenticated).
roles
The array of roles the user has, including from the role hierarchy but not including the IS_AUTHENTICATED_* attributes (see the functions below).
object
The object (if any) that's passed as the second argument to isGranted().
token
The token object.
trust_resolver
The AuthenticationTrustResolverInterface, object: you'll probably use the is_*() functions below instead.

Additionally, you have access to a number of functions inside the expression:

is_authenticated
Returns true if the user is authenticated via "remember-me" or authenticated "fully" - i.e. returns true if the user is "logged in".
is_anonymous
Equal to using IS_AUTHENTICATED_ANONYMOUSLY with the isGranted() function.
is_remember_me
Similar, but not equal to IS_AUTHENTICATED_REMEMBERED, see below.
is_fully_authenticated
Similar, but not equal to IS_AUTHENTICATED_FULLY, see below.
has_role
Checks to see if the user has the given role - equivalent to an expression like 'ROLE_ADMIN' in roles.

is_remember_me is different than checking IS_AUTHENTICATED_REMEMBERED

The is_remember_me() and is_authenticated_fully() functions are similar to using IS_AUTHENTICATED_REMEMBERED and IS_AUTHENTICATED_FULLY with the isGranted() function - but they are not the same. The following shows the difference:

1
2
3
4
5
6
7
8
9
use Symfony\Component\ExpressionLanguage\Expression;
// ...

$ac = $this->get('security.authorization_checker');
$access1 = $ac->isGranted('IS_AUTHENTICATED_REMEMBERED');

$access2 = $ac->isGranted(new Expression(
    'is_remember_me() or is_fully_authenticated()'
));

Here, $access1 and $access2 will be the same value. Unlike the behavior of IS_AUTHENTICATED_REMEMBERED and IS_AUTHENTICATED_FULLY, the is_remember_me() function only returns true if the user is authenticated via a remember-me cookie and is_fully_authenticated only returns true if the user has actually logged in during this session (i.e. is full-fledged).

Learn more

  • How to Inject Values Based on Complex Expressions
  • Expression
This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.
TOC
    Version
    We stand with Ukraine.
    Version:
    Symfony Code Performance Profiling

    Symfony Code Performance Profiling

    Peruse our complete Symfony & PHP solutions catalog for your web development needs.

    Peruse our complete Symfony & PHP solutions catalog for your web development needs.

    Symfony footer

    ↓ Our footer now uses the colors of the Ukrainian flag because Symfony stands with the people of Ukraine.

    Avatar of Bert Ramakers, a Symfony contributor

    Thanks Bert Ramakers for being a Symfony contributor

    2 commits • 150 lines changed

    View all contributors that help us make Symfony

    Become a Symfony contributor

    Be an active part of the community and contribute ideas, code and bug fixes. Both experts and newcomers are welcome.

    Learn how to contribute

    Symfony™ is a trademark of Symfony SAS. All rights reserved.

    • What is Symfony?

      • Symfony at a Glance
      • Symfony Components
      • Case Studies
      • Symfony Releases
      • Security Policy
      • Logo & Screenshots
      • Trademark & Licenses
      • symfony1 Legacy
    • Learn Symfony

      • Symfony Docs
      • Symfony Book
      • Reference
      • Bundles
      • Best Practices
      • Training
      • eLearning Platform
      • Certification
    • Screencasts

      • Learn Symfony
      • Learn PHP
      • Learn JavaScript
      • Learn Drupal
      • Learn RESTful APIs
    • Community

      • SymfonyConnect
      • Support
      • How to be Involved
      • Code of Conduct
      • Events & Meetups
      • Projects using Symfony
      • Downloads Stats
      • Contributors
      • Backers
    • Blog

      • Events & Meetups
      • A week of symfony
      • Case studies
      • Cloud
      • Community
      • Conferences
      • Diversity
      • Documentation
      • Living on the edge
      • Releases
      • Security Advisories
      • SymfonyInsight
      • Twig
      • SensioLabs
    • Services

      • SensioLabs services
      • Train developers
      • Manage your project quality
      • Improve your project performance
      • Host Symfony projects

      Deployed on

    Follow Symfony

    Search by Meilisearch