The Security component provides a complete security system for your web application.

Related tags

Security php security symfony component symfony-component
Overview

Security Component

The Security component provides a complete security system for your web application. It ships with facilities for authenticating using HTTP basic, interactive form login or X.509 certificate login, but also allows you to implement your own authentication strategies. Furthermore, the component provides ways to authorize authenticated users based on their roles.

Resources

Comments
  • Update MessageDigestPasswordEncoder.php

    Update MessageDigestPasswordEncoder.php

    Hello, I made this change to make an LDAP authentification with SSHA encrypted passwords. Maybe, It's already done but I haven't found. So, in the file security.yml, I put for the encoder: SSHA. However, I haven't tried this for add new user.

    Best regards.

    opened by royceda 2
  • Moved exception message key to a constant.

    Moved exception message key to a constant.

    We override the exception method in translation as users don't know what a CSRF token is, or why it is invalid. Using a public constant is more consistent for overriding in the translations.

    opened by mogilvie 1
  • Update AbstractAuthenticationListener.php

    Update AbstractAuthenticationListener.php

    After 2 hours of searching I finally found it:

     Authentication request failed. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\AuthenticationServiceException(code: 0)
...
Unknown column 't0.phone' in 'field list'.

    I think defenitely this is not info, but error.

    opened by Warxcell 1
  • [Security][Guard] Check whether $this->logger is not null on GuardAuthenticationListener

    [Security][Guard] Check whether $this->logger is not null on GuardAuthenticationListener

    | Q | A | | --- | --- | | Bug fix? | yes | | New feature? | no | | BC breaks? | no | | Deprecations? | no | | Tests pass? | yes | | Fixed tickets | #16415 | | License | MIT |

    opened by aeoris 0
  • Fixed incorrect and inconsistent translations

    Fixed incorrect and inconsistent translations

    "Fiş" is a correct translation for "token", however "bilet" is also used, I fixed that inconsistency. Moreover, "kimlik bilgileri" is a better translation for "credentials" than "girdiler". "Girdiler" is the translation of "inputs", so I fixed sentences with "credentials". "Hesap engellenmiş" is better than "Hesap devre dışı bırakılmış" for "Account is disabled.". "Digest nonce has expired" can be translated better as "Derleme zaman aşımına uğradı." because "Derleme zaman aşımı gerçekleşti" has a confirmation sense like user requested it to expire and it has expired.

    References:

    token: http://tureng.com/search/token (3rd entry) credentials: http://www2.zargan.com/tr/q/credentials-ceviri-nedir (1st entry) disable: http://tureng.com/search/disable (15th entry)

    opened by lashae 0
  • Made $map protected and moved it to __construct()

    Made $map protected and moved it to __construct()

    By making $map protected and moving the actual declaration to the __construct, you make it easier to extend the BasicPermissionMap.

    At the moment, if you want to extend it, you have to copy/paste the entire $map variable into your own class. I feel it makes more sense to call the parent::__construct in your own mapping and add your own mappings to the variable, instead of having to replace it completely. 

    opened by Brammm 0
Releases(v4.4.48)

  • v4.4.48(Oct 28, 2022)

    Changelog (https://github.com/symfony/security/compare/v4.4.47...v4.4.48)

    • bug #47932 Throw LogicException instead of Error when trying to generate logout-… (addiks)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.47(Oct 12, 2022)

  • v4.4.46(Sep 30, 2022)

    Changelog (https://github.com/symfony/security/compare/v4.4.45...v4.4.46)

    • bug #47578 Fix AbstractFormLoginAuthenticator return types (AndrolGenhald)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.44(Jul 29, 2022)

    Changelog (https://github.com/symfony/security/compare/v4.4.43...v4.4.44)

    • bug #47069 Allow redirect after login to absolute URLs (Tim Ward)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.42(May 27, 2022)

    Changelog (https://github.com/symfony/security/compare/v4.4.41...v4.4.42)

    • bug #46317 Ignore invalid URLs found in failure/success paths (nicolas-grekas)
    • bug #46262 Fix removing listeners when using first-class callable syntax (javer)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.41(Apr 27, 2022)

  • v4.4.38(Feb 28, 2022)

    Changelog (https://github.com/symfony/security/compare/v4.4.37...v4.4.38)

    • bug #44259 AccountStatusException::$user should be nullable (Cantepie)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.37(Jan 28, 2022)

  • v4.4.36(Dec 29, 2021)

  • v4.4.34(Nov 22, 2021)

  • v4.4.33(Oct 29, 2021)

  • v4.4.31(Sep 28, 2021)

  • v4.4.30(Aug 30, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.29...v4.4.30)

    • bug #42621 Don't produce TypeErrors for non-string CSRF tokens (derrabus)
    • bug #42260 Fix return types for PHP 8.1 (derrabus)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.29(Jul 29, 2021)

  • v4.4.27(Jul 26, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.26...v4.4.27)

    • bug #42174 Indicate compatibility with psr/log 2 and 3 (derrabus)
    • bug #41384 Fix SkippedTestSuite (jderusse)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.26(Jun 30, 2021)

  • v4.4.25(Jun 1, 2021)

  • v4.4.24(May 19, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.23...v4.4.24)

    • bug #41240 Fixed deprecation warnings about passing null as parameter (derrabus)
    Source code(tar.gz)
    Source code(zip)

  • v3.4.49(May 19, 2021)

  • v4.4.23(May 12, 2021)

  • v3.4.48(May 12, 2021)

  • v4.4.22(May 1, 2021)

  • v4.4.21(Mar 29, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.20...v4.4.21)

    • bug #39992 Refresh original user in SwitchUserListener (AndrolGenhald)
    • bug #40386 Backport psr/container 1.1/2.0 compatibility (derrabus)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.20(Mar 4, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.19...v4.4.20)

    • bug #40066 fix parsing return types in DebugClassLoader (nicolas-grekas)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.19(Jan 27, 2021)

    Changelog (https://github.com/symfony/security/compare/v4.4.18...v4.4.19)

    • bug #39880 Add username to UserNameNotFoundException (qurben)
    • bug #39862 Replace message data in JSON security error response (wouterj)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.18(Dec 18, 2020)

    Changelog (https://github.com/symfony/security/compare/v4.4.17...v4.4.18)

    • bug #39331 Fixed PHPunit 9.5 compatibility (wouterj)
    • bug #39247 remove return type definition in order to avoid type juggling (adeptofvoltron)
    Source code(tar.gz)
    Source code(zip)

  • v4.4.17(Nov 29, 2020)

    Changelog (https://github.com/symfony/security/compare/v4.4.16...v4.4.17)

    • bug #39068 Silent deprecation triggered by libxml_disable_entity_loader (jderusse)
    Source code(tar.gz)
    Source code(zip)

  • v3.4.47(Nov 27, 2020)

  • v4.4.16(Oct 28, 2020)

  • v3.4.46(Oct 28, 2020)

Owner
Symfony
Symfony
GitHub https://symfony.com/components/Security
Security CSRF (cross-site request forgery) component provides a class CsrfTokenManager for generating and validating CSRF tokens.

Security Component - CSRF The Security CSRF (cross-site request forgery) component provides a class CsrfTokenManager for generating and validating CSR

Symfony 1.5k Jan 3, 2023
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected i

Daniel Miessler 44.1k Jan 7, 2023
Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.

Sam Sanoop 416 Dec 17, 2022
Security Component - Guard

The Guard component brings many layers of authentication together, making it much easier to create complex authentication systems where you have total control.

Symfony 1.4k Jan 5, 2023
A multitool library offering access to recommended security related libraries, standardised implementations of security defences, and secure implementations of commonly performed tasks.

SecurityMultiTool A multitool library offering access to recommended security related libraries, standardised implementations of security defences, an

Pádraic Brady 131 Oct 30, 2022
Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campbell/security-core

Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campb

Graham Campbell 170 Nov 20, 2022
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code

phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code.

Floe design + technologies 654 Dec 28, 2022
Security provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. It is inspired by the Java Spring framework.

Security Component - Core Security provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the

Symfony 1.6k Jan 1, 2023
Security provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials.

Security provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. It is inspired by the Java Spring framework.

Symfony 1.5k Dec 28, 2022
Web page performance/seo/security/accessibility analysis, browser-less for PHP

Web page performance/seo/security/accessibility analysis, browser-less for PHP

Lightship 5 Dec 15, 2022
Fides provides your servers with a trusted CA certificate, and signs your OpenSSH certificates with the same key

Fides is an SSH certificate signing server. It enables zero-trust infrastructure for your engineers by dynamically, and transparently, issuing short-lived certificates with clearly defined permissions.

Moritz Friedrich 3 Dec 28, 2022
Web Shells that can bypass system firewalls

No System Is Safe Summary Tsayou web shell is a backdoor built using the PHP programming language and designed to bypass multiple system firewalls on

22XploiterCrew 26 Jun 21, 2021
This repository contains the sources of OXID eShop Community Edition Core Component.

OXID eShop This repository contains the sources of OXID eShop Community Edition Core Component. About OXID eShop: OXID eShop is a flexible open source

OXID eSales AG 209 Dec 14, 2022
Cryptographic component from Zend Framework

zend-crypt Repository abandoned 2019-12-31 This repository has moved to laminas/laminas-crypt. Zend\Crypt provides support of some cryptographic tools

Zend Framework 89 Dec 4, 2021
A database of PHP security advisories

PHP Security Advisories Database The PHP Security Advisories Database references known security vulnerabilities in various PHP projects and libraries.

null 1.9k Dec 18, 2022
A php.ini scanner for best security practices

Scanner for PHP.ini The Iniscan is a tool designed to scan the given php.ini file for common security practices and report back results. Currently it

psec.io 1.5k Dec 5, 2022
FunboxEasy - Proving Grounds - Offensive Security

FunboxEasy - Proving Grounds - Offensive Security

Hafiizh Ghulam 1 Oct 28, 2021
Php Security Class

Security Advanced Security Class for Php Features Secure From XSS, CSRF, SQL Injection, BASE64, RFI, LFI, Command Injection, Block Suspicious Request

Ömer Faruk Demirel 5 Dec 2, 2022
Windows and macOS Hardening Interface to make security more accessible.

Welcome to the Hardening Interface Introduction To use HardeningKitty service more easily, we have created an interface which permits better understan

ataumo 24 Dec 5, 2022