How to Secure any Service or Method in your Application

In the security article, you can see how to secure a controller by requesting the security.authorization_checker service from the Service Container and checking the current user's role:

1
2
3
4
5
6
7
8
9

// ...
use Symfony\Component\Security\Core\Exception\AccessDeniedException;

public function helloAction($name)
{
    $this->denyAccessUnlessGranted('ROLE_ADMIN');

    // ...
}

You can also secure any service by injecting the security.authorization_checker service into it. For a general introduction to injecting dependencies into services see the Service Container article. For example, suppose you have a NewsletterManager class that sends out emails and you want to restrict its use to only users who have some ROLE_NEWSLETTER_ADMIN role. Before you add security, the class looks something like this:

1
2
3
4
5
6
7
8
9
10
11
12

// src/AppBundle/Newsletter/NewsletterManager.php
namespace AppBundle\Newsletter;

class NewsletterManager
{
    public function sendNewsletter()
    {
        // ... where you actually do the work
    }

    // ...
}

Your goal is to check the user's role when the sendNewsletter() method is called. The first step towards this is to inject the security.helper service using the Security class:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

// src/AppBundle/Newsletter/NewsletterManager.php

// ...
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Core\Security;

class NewsletterManager
{
    protected $security;

    public function __construct(Security $security)
    {
        $this->security = $security;
    }

    public function sendNewsletter()
    {
        if (!$this->security->isGranted('ROLE_NEWSLETTER_ADMIN')) {
            throw new AccessDeniedException();
        }

        // ...
    }

    // ...
}

If you're using the default services.yml configuration, Symfony will automatically pass the security.helper to your service thanks to autowiring and the Security type-hint.

If the current user does not have the ROLE_NEWSLETTER_ADMIN, they will be prompted to log in.