Symfony2 Registration and Login

This article details Symfony2's user registration, login, and post-login processes. We'll build upon the database and security configuration from Part 1, focusing on form creation, user object persistence, and secure password handling.

Key Concepts:

• Registration: A form collects user data (email, username, password, etc.), maps it to a User object, and persists this object to the database. A custom form type (RegistrationType) manages field mapping and data handling. The application automatically hashes the password for security.
• Login: A simple login form, submitting to /login_check, requires "_username" and "_password" fields—as mandated by Symfony's security system.
• Post-Login Actions: Symfony's security interface lacks direct post-login hooks. We'll implement a custom authentication success handler to update the user's last login timestamp.

Form, Database, and the RegistrationType:

The registration process uses a form. The RegistrationType (located in src/AppBundle/Form/Type/RegistrationType.php) defines the form's structure:

class RegistrationType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options)
    {
        $builder->add('username', 'text', ['label' => 'User Name'])
                ->add('password', 'password', ['label' => 'Password'])
                ->add('confirm', 'password', ['mapped' => false, 'label' => 'Re-type password'])
                ->add('homepage', 'text', ['label' => 'Homepage'])
                ->add('email', 'hidden', ['label' => 'email'])
                ->add('save', 'submit', ['label' => 'Register']);
    }

    // ... (getName and setDefaultOptions methods) ...
}

'mapped' => false prevents the "confirm" field from being saved to the database. The form is created and rendered using Twig:

{{ form_widget(form.username, {'attr': {'class': 'form-control', 'placeholder':'User Name'}}) }}
{{ form_widget(form.password, {'attr': {'class': 'form-control', 'placeholder':'Password'}}) }}
{{ form_widget(form.confirm, {'attr': {'class': 'form-control', 'placeholder':'Confirm Password'}}) }}
{{ form_widget(form.homepage, {'attr': {'class': 'form-control', 'placeholder':'Homepage'}}) }}
{{ form_widget(form.email, {'attr': {'value': email}}) }}
<!-- ... rest of the form ... -->

User Creation:

The createAction handles form submission, creates a User object, sets non-user-provided properties (created date, roles, gravatar), encrypts the password using Symfony's password encoder, and persists the user:

public function createAction(Request $req)
{
    // ... (get entity manager, create form, handle request) ...

    $user = $form->getData();
    $user->setCreated(new \DateTime());
    $user->setRoles(['ROLE_USER']);
    // ... (set gravatar and active status) ...

    $pwd = $user->getPassword();
    $encoder = $this->container->get('security.password_encoder');
    $pwd = $encoder->encodePassword($user, $pwd);
    $user->setPassword($pwd);

    $em->persist($user);
    $em->flush();

    return $this->redirect($this->generateUrl('login'));
}

Login and Post-Login Handling:

The login form (pointing to /login_check) is straightforward:

<!-- ... login form with _username and _password fields ... -->

Post-login actions require a custom authentication success handler (defined in src/AppBundle/Handler/AuthenticationSuccessHandler.php and registered in services.yml):

class AuthenticationSuccessHandler extends DefaultAuthenticationSuccessHandler
{
    // ... (constructor with dependency injection) ...

    public function onAuthenticationSuccess(Request $request, TokenInterface $token)
    {
        $user = $token->getUser();
        $user->setLogged(new \DateTime());
        $em = $this->container->get('doctrine.orm.entity_manager');
        $em->persist($user);
        $em->flush();
        return $this->httpUtils->createRedirectResponse($request, $this->determineTargetUrl($request));
    }
}

This handler updates the logged field in the User object after successful authentication.

This comprehensive guide covers Symfony2's registration and login features, emphasizing security best practices and customizability. Further customization, such as form validation and social login integration, can be explored based on specific application requirements.

The above is the detailed content of Symfony2 Registration and Login. For more information, please follow other related articles on the PHP Chinese website!