Using Expressions in Security Access Controls

In addition to security roles like ROLE_ADMIN, the isGranted() method and #[IsGranted()] attribute also accept an Expression object:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

// src/Controller/MyController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Http\Attribute\IsGranted;

class MyController extends AbstractController
{
    #[IsGranted(new Expression('is_granted("ROLE_ADMIN") or is_granted("ROLE_MANAGER")'))]
    public function show(): Response
    {
        // ...
    }

    #[IsGranted(new Expression(
        '"ROLE_ADMIN" in role_names or (is_authenticated() and user.isSuperAdmin())'
    ))]
    public function edit(): Response
    {
        // ...
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// src/Controller/MyController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\HttpFoundation\Response;

class MyController extends AbstractController
{
    public function show(): Response
    {
        $this->denyAccessUnlessGranted(new Expression(
            'is_granted("ROLE_ADMIN") or is_granted("ROLE_MANAGER")'
        ));

        // ...
    }

    public function edit(): Response
    {
        $this->denyAccessUnlessGranted(new Expression(
            '"ROLE_ADMIN" in role_names or (is_authenticated() and user.isSuperAdmin())'
        ));

        // ...
    }
}

In this example, if the current user has ROLE_ADMIN or if the current user object's isSuperAdmin() method returns true, then access will be granted (note: your User object may not have an isSuperAdmin() method, that method is invented for this example).

The security expression must use any valid expression language syntax and can use any of these variables created by Symfony:

user

An instance of UserInterface that represents the current user or null if you're not authenticated.

role_names

An array with the string representation of the roles the user has. This array includes any roles granted indirectly via the role hierarchy but it does not include the IS_AUTHENTICATED_* attributes (see the functions below).

object

The object (if any) that's passed as the second argument to isGranted().

subject

It stores the same value as object, so they are equivalent.

token

The token object.

trust_resolver

The AuthenticationTrustResolverInterface, object: you'll probably use the is_*() functions below instead.

Additionally, you have access to a number of functions inside the expression:

is_authenticated()

Returns true if the user is authenticated via "remember-me" or authenticated "fully" - i.e. returns true if the user is "logged in".

is_remember_me()

Similar, but not equal to IS_AUTHENTICATED_REMEMBERED, see below.

is_fully_authenticated()

Equal to checking if the user has the IS_AUTHENTICATED_FULLY role.

is_granted()

Checks if the user has the given permission. Optionally accepts a second argument with the object where permission is checked on. It's equivalent to using the isGranted() method from the security service.

1
2
3
4
5
6
7
8
9
10
11
12

use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
// ...

public function index(AuthorizationCheckerInterface $authorizationChecker): Response
{
    $access1 = $authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED');

    $access2 = $authorizationChecker->isGranted(new Expression(
        'is_remember_me() or is_fully_authenticated()'
    ));
}

In case of the #[IsGranted()] attribute, the subject can also be an Expression object:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// src/Controller/MyController.php
namespace App\Controller;

use App\Entity\Post;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Http\Attribute\IsGranted;

class MyController extends AbstractController
{
    #[IsGranted(
        attribute: new Expression('user === subject'),
        subject: new Expression('args["post"].getAuthor()'),
    )]
    public function index(Post $post): Response
    {
        // ...
    }
}

In this example, we fetch the author of the post and use it as the subject. If the subject matches the current user, then access will be granted.

The subject may also be an array where the key can be used as an alias for the result of an expression:

1
2
3
4
5
6
7
8
9
10
11

#[IsGranted(
    attribute: new Expression('user === subject["author"] and subject["post"].isPublished()'),
    subject: [
        'author' => new Expression('args["post"].getAuthor()'),
        'post',
    ],
)]
public function index(Post $post): Response
{
    // ...
}

Here, access will be granted if the author matches the current user and the post's isPublished() method returns true.

You can also use the current request as the subject:

1
2
3
4
5
6
7
8

#[IsGranted(
    attribute: '...',
    subject: new Expression('request'),
)]
public function index(): Response
{
    // ...
}

Inside the subject's expression, you have access to two variables:

request

The Symfony Request object that represents the current request.

args

An array of controller arguments that are passed to the controller.