How to Build a JSON Authentication Endpoint
Edit this pageWarning: You are browsing the documentation for Symfony 4.0, which is no longer maintained.
Read the updated version of this page for Symfony 6.1 (the current stable version).
How to Build a JSON Authentication Endpoint
In this entry, you'll build a JSON endpoint to log in your users. Of course, when the user logs in, you can load your users from anywhere - like the database. See Security for details.
First, enable the JSON login under your firewall:
- YAML
- XML
- PHP
1 2 3 4 5 6 7 8 9
# config/packages/security.yaml
security:
# ...
firewalls:
main:
anonymous: ~
json_login:
check_path: /login
Tip
The check_path
can also be a route name (but cannot have mandatory wildcards - e.g.
/login/{foo}
where foo
has no default value).
Now, when a request is made to the /login
URL, the security system initiates
the authentication process. You just need to configure a route matching this
path:
- Annotations
- YAML
- XML
- PHP
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// src/Controller/SecurityController.php
// ...
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Routing\Annotation\Route;
class SecurityController extends Controller
{
/**
* @Route("/login", name="login")
*/
public function login(Request $request)
{
}
}
Don't let this empty controller confuse you. When you submit a POST
request
to the /login
URL with the following JSON document as the body, the security
system intercepts the requests. It takes care of authenticating the user with
the submitted username and password or triggers an error in case the authentication
process fails:
1 2 3 4
{
"username": "dunglas",
"password": "MyPassword"
}
If the JSON document has a different structure, you can specify the path to
access the username
and password
properties using the username_path
and password_path
keys (they default respectively to username
and
password
). For example, if the JSON document has the following structure:
1 2 3 4 5 6 7 8
{
"security": {
"credentials": {
"login": "dunglas",
"password": "MyPassword"
}
}
}
The security configuration should be:
- YAML
- XML
- PHP
1 2 3 4 5 6 7 8 9 10 11
# config/packages/security.yaml
security:
# ...
firewalls:
main:
anonymous: ~
json_login:
check_path: login
username_path: security.credentials.login
password_path: security.credentials.password