The Entry Point: Helping Users Start Authentication

When an unauthenticated user tries to access a protected page, Symfony gives them a suitable response to let them start authentication (e.g. redirect to a login form or show a 401 Unauthorized HTTP response for APIs).

However, sometimes one firewall has multiple ways to authenticate (e.g. both a form login and a social login). In these cases, it is required to configure the authentication entry point.

You can configure this using the entry_point setting:

        1
2
3
4
5
6
7
8
9
10
11
12
13
        # config/packages/security.yaml
security:

    # ...
    firewalls:
        main:
            # allow authentication using a form or a custom authenticator
            form_login: ~
            custom_authenticators:
                - App\Security\SocialConnectAuthenticator

            # configure the form authentication as the entry point for unauthenticated users
            entry_point: form_login
    

Note

You can also create your own authentication entry point by creating a class that implements AuthenticationEntryPointInterface. You can then set entry_point to the service id (e.g. entry_point: App\Security\CustomEntryPoint)

Some authenticators (e.g. json_login or custom authenticators) don't redirect anonymous users to a login page. Instead of creating an entry point class only to return that redirection, set the entry_point_path option of the firewall:

        1
2
3
4
5
6
7
8
9
10
11
        # config/packages/security.yaml
security:
    # ...
    firewalls:
        main:
            json_login:
                check_path: api_login

            # a path (/login), an absolute URL (https://example.com/login)
            # or a route name where anonymous users are redirected to log in
            entry_point_path: app_login
    

This option accepts the same values as the login_path option of form_login. It works even if the firewall doesn't define any authenticator, but you can't use it together with the entry_point option.

Before redirecting, the firewall stores the requested URL in the session, so you can send users back to it after they log in. This only happens in stateful firewalls and for safe requests (e.g. GET) that are not AJAX requests.

8.2

The entry_point_path option was introduced in Symfony 8.2.

Multiple Authenticators with Separate Entry Points

However, there are use cases where you have authenticators that protect different parts of your application. For example, you have a login form that protects the main website and API end-points used by external parties protected by API keys.

As you can only configure one entry point per firewall, the solution is to split the configuration into two separate firewalls:

        1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
        # config/packages/security.yaml
security:
    # ...
    firewalls:
        api:
            pattern: ^/api/
            custom_authenticators:
                - App\Security\ApiTokenAuthenticator
        main:
            lazy: true
            form_login: ~

    access_control:
        - { path: '^/login', roles: PUBLIC_ACCESS }
        - { path: '^/api', roles: ROLE_API_USER }
        - { path: '^/', roles: ROLE_USER }
    

This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.

TOC

Version

The Entry Point: Helping Users Start Authentication

Redirecting Anonymous Users to a Login Page

Multiple Authenticators with Separate Entry Points