Symfony
sponsored by SensioLabs
Menu
  • About
  • Documentation
  • Screencasts
  • Cloud
  • Certification
  • Community
  • Businesses
  • News
  • Download
  1. Home
  2. Documentation
  3. Security
  4. Using Expressions in Security Access Controls
  • Documentation
  • Book
  • Reference
  • Bundles
  • Cloud
Search by Algolia
  • Learn more

Using Expressions in Security Access Controls

Edit this page

Using Expressions in Security Access Controls

See also

The best solution for handling complex authorization rules is to use the Voter System.

In addition to security roles like ROLE_ADMIN, the isGranted() method and #[IsGranted()] attribute also accept an Expression object:

  • Attributes
  • PHP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// src/Controller/MyController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\HttpFoundation\Response;

class MyController extends AbstractController
{
    #[IsGranted(new Expression(
        '"ROLE_ADMIN" in role_names or (is_authenticated() and user.isSuperAdmin())'
    ))]
    public function index(): Response
    {
        // ...
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
// src/Controller/MyController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\HttpFoundation\Response;

class MyController extends AbstractController
{
    public function index(): Response
    {
        $this->denyAccessUnlessGranted(new Expression(
            '"ROLE_ADMIN" in role_names or (is_authenticated() and user.isSuperAdmin())'
        ));

        // ...
    }
}

6.2

The #[IsGranted()] attribute was introduced in Symfony 6.2.

In this example, if the current user has ROLE_ADMIN or if the current user object's isSuperAdmin() method returns true, then access will be granted (note: your User object may not have an isSuperAdmin() method, that method is invented for this example).

The security expression must use any valid expression language syntax and can use any of these variables created by Symfony:

user
An instance of UserInterface that represents the current user or null if you're not authenticated.
role_names
An array with the string representation of the roles the user has. This array includes any roles granted indirectly via the role hierarchy but it does not include the IS_AUTHENTICATED_* attributes (see the functions below).
object
The object (if any) that's passed as the second argument to isGranted().
subject
It stores the same value as object, so they are equivalent.
token
The token object.
trust_resolver
The AuthenticationTrustResolverInterface, object: you'll probably use the is_*() functions below instead.

Additionally, you have access to a number of functions inside the expression:

is_authenticated()
Returns true if the user is authenticated via "remember-me" or authenticated "fully" - i.e. returns true if the user is "logged in".
is_remember_me()
Similar, but not equal to IS_AUTHENTICATED_REMEMBERED, see below.
is_fully_authenticated()
Equal to checking if the user has the IS_AUTHENTICATED_FULLY role.
is_granted()
Checks if the user has the given permission. Optionally accepts a second argument with the object where permission is checked on. It's equivalent to using the isGranted() method from the security service.

is_remember_me() is different than checking IS_AUTHENTICATED_REMEMBERED

The is_remember_me() and is_fully_authenticated() functions are similar to using IS_AUTHENTICATED_REMEMBERED and IS_AUTHENTICATED_FULLY with the isGranted() function - but they are not the same. The following controller snippet shows the difference:

1
2
3
4
5
6
7
8
9
10
11
12
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
// ...

public function index(AuthorizationCheckerInterface $authorizationChecker): Response
{
    $access1 = $authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED');

    $access2 = $authorizationChecker->isGranted(new Expression(
        'is_remember_me() or is_fully_authenticated()'
    ));
}

Here, $access1 and $access2 will be the same value. Unlike the behavior of IS_AUTHENTICATED_REMEMBERED and IS_AUTHENTICATED_FULLY, the is_remember_me() function only returns true if the user is authenticated via a remember-me cookie and is_fully_authenticated() only returns true if the user has actually logged in during this session (i.e. is full-fledged).

Learn more

  • How to Inject Values Based on Complex Expressions
  • Expression
This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.
We stand with Ukraine.
Version:

Symfony Security is backed by

Show your Sylius expertise

Show your Sylius expertise

Measure & Improve Symfony Code Performance

Measure & Improve Symfony Code Performance

↓ Our footer now uses the colors of the Ukrainian flag because Symfony stands with the people of Ukraine.

Avatar of Cyril Pascal, a Symfony contributor

Thanks Cyril Pascal (@paxal) for being a Symfony contributor

3 commits • 32 lines changed

View all contributors that help us make Symfony

Become a Symfony contributor

Be an active part of the community and contribute ideas, code and bug fixes. Both experts and newcomers are welcome.

Learn how to contribute

Symfony™ is a trademark of Symfony SAS. All rights reserved.

  • What is Symfony?
    • Symfony at a Glance
    • Symfony Components
    • Case Studies
    • Symfony Releases
    • Security Policy
    • Logo & Screenshots
    • Trademark & Licenses
    • symfony1 Legacy
  • Learn Symfony
    • Symfony Docs
    • Symfony Book
    • Reference
    • Bundles
    • Best Practices
    • Training
    • eLearning Platform
    • Certification
  • Screencasts
    • Learn Symfony
    • Learn PHP
    • Learn JavaScript
    • Learn Drupal
    • Learn RESTful APIs
  • Community
    • SymfonyConnect
    • Support
    • How to be Involved
    • Code of Conduct
    • Events & Meetups
    • Projects using Symfony
    • Downloads Stats
    • Contributors
    • Backers
  • Blog
    • Events & Meetups
    • A week of symfony
    • Case studies
    • Cloud
    • Community
    • Conferences
    • Diversity
    • Documentation
    • Living on the edge
    • Releases
    • Security Advisories
    • SymfonyInsight
    • Twig
    • SensioLabs
  • Services
    • SensioLabs services
    • Train developers
    • Manage your project quality
    • Improve your project performance
    • Host Symfony projects
    Deployed on
Follow Symfony
Search by Algolia