Symfony2：安全/安全登錄和註銷

Question

我應該添加什麼來處理安全和安全的登錄和註銷？

對於登錄我從數據庫中簡單地獲取和驗證的信息，然後我設置會話和餅乾：

if ($users) { //$users - fetched array of users 
    foreach ($users as $user) { 
     $response->headers->setCookie(new Cookie('user', $cookie, $expire, $path = '/', $domain = '', $secure = false, $httpOnly = false)); 
     $response->sendHeaders(); 

     foreach ($user as $key => $value) { 
      //setting every user information to session except password 
      $session->set($key, $value); 
     } 
    } 
} 

而對於註銷我只是刪除會話和餅乾：

$response->headers->clearCookie('user'); 
$response->sendHeaders(); 

$request->getSession()->invalidate(); 

「用戶'我設置爲Cookie的值由以下項生成：

$password = $user['password']; //is already in md5 
$username = $user['email']; 
$cookie = base64_encode ("$username:" . md5 ($password)); 

所有這些都存儲到主控制器。

Answer 1

這實在不是登錄和註銷實施的好方法。看看Symfony2安全教程。使用UserProvider從數據庫中獲取用戶，並在成功時設置安全令牌。

一開始 - http://symfony.com/doc/current/cookbook/security/custom_provider.html

MD5函數不再安全。如果你願意，可以使用比密碼更強的密碼和salt。

Answer 2

如果您按照Symfony cookbook中所述實施用戶提供商和存儲庫，則可以按照這種方式以編程方式登錄和註銷用戶。

下面是一個示例實現：

登錄：

$username = $user['email']; 
$password = $user['password']; // NOTE: must be plain-text at this point 

$User = $this->container->get('doctrine')->getManager() 
    ->getRepository('TixysBackendBundle:User') 
    ->findOneBy(array('login' => $username)); 

if (!$User) throw \Exception("User not found!"); 

$factory = $this->container->get('security.encoder_factory'); 
$encoder = $factory->getEncoder($User); 
$password = $encoder->encodePassword($password, $User->getSalt()); 

if ($password != $User->getPassword()) 
    throw new \Exception("Wrong password."); 

// actual login 
$token = new UsernamePasswordToken($User, null, 'secured_area', $User->getRoles()); 
$this->container->get('security.context')->setToken($token); 

註銷：

$this->container->get('security.context')->setToken(null); 
$this->container->get('session')->invalidate(); 

// If you've stored an instance of the previously authenticated user 
// somewhere, destroy that instance, too. 

你並不需要關心的實際哈希算法這一點，鑑於您在app/config/security.yml中的設置已正確完成。