Weave Code
Symfony Authenticator Restrictor Bundle Laravel Package
halloverden/symfony-authenticator-restrictor-bundle
A Symfony bundle for restricting which authenticators are available in your application. Configure rules to control when specific authentication methods can be used, giving fine-grained control over login flows without custom security code.
Symfony bundle for restricting authenticator(s) to specific route
Frequently asked questions about Symfony Authenticator Restrictor Bundle
- Is halloverden/symfony-authenticator-restrictor-bundle a Laravel package?
- No. It is a Symfony bundle built around Symfony's authenticator-based security, so it has no integration with Laravel's auth middleware, guard drivers, or auth:<guard> route groups. For a Laravel application, implement the equivalent with per-guard route groups and native middleware instead of adopting this package.
- How do I install and configure the Symfony authenticator restrictor bundle?
- Install it with Composer, enable the bundle in your Symfony kernel or bundles config, then add the configuration block that maps authenticator service IDs to the route or path patterns where they may run. After changing the config, clear the cache and verify the compiled container. Installation is trivial; the real work is proving the restriction semantics with tests.
- What exactly does the bundle restrict, and where does it hook into Symfony security?
- It restricts which configured authenticators are active for a given request or firewall, typically by decorating authenticator service definitions with a request matcher. It is not a replacement for Symfony's access_control rules or authorization voters; it only controls whether an authentication method is offered. That makes it a narrow negative-control layer in the login flow.
- What happens when no restriction rule matches a request?
- That default is the most important thing to audit before production use. An unmatched request that suppresses an authenticator can cause a lockout, while one that permits it can create an auth bypass. Confirm the behavior in the source and cover it with an explicit test rather than assuming either direction.
- Does this bundle support Symfony 7 and symfony/security-bundle 7.x?
- The overview does not declare version support, so you must inspect the package's composer.json constraints and test matrix. Given the project's low activity, treat Symfony 6.x and 7.x compatibility as unproven until you run it in a real application. Pin a version and re-test on every Symfony upgrade because authenticator internals and lazy firewall behavior can change.
- How do I test that a restricted authenticator cannot be used on a route?
- Build a test matrix that sends requests to each protected route and each excluded route, then asserts the positive and negative cases: the intended authenticator fires and the restricted one does not. A smoke test is not enough because this bundle's value is a negative control in the auth path. Include sub-requests, forwarded headers, and any route-name or path-prefix changes in that matrix.
- How does it behave with lazy firewalls, stateless firewalls, or multiple authenticators on one firewall?
- Multiple authenticators on a single firewall is the legitimate use case this bundle targets, especially when splitting the firewall would duplicate context, remember_me, logout, and access-control config. Lazy and stateless firewalls are where subtle issues are most likely, so verify the request matcher against those modes. Also check behavior on Symfony 6.x and 7.x where authenticator deprecations and lazy firewall handling have changed.
- What are the alternatives to this bundle for restricting authenticators in Symfony?
- Prefer native configuration first: firewall patterns, a custom RequestMatcher, entry_point settings, security.access_control, and per-route IS_AUTHENTICATED rules can often express the constraint without extra packages. Splitting the firewall by pattern is the other option, but it can duplicate session, remember_me, and logout configuration. Reach for this bundle only when native options force that split or cannot express the rule cleanly.
- Is this package safe for production given zero stars and no dependents?
- Treat it as a security-adjacent component with a bus factor of one: there is no community review, unknown CI, and no visible security advisory channel. The compensating factor is a small blast radius and a source tree short enough to audit fully, so read all of it rather than trusting the abstraction. Pin a version, add your own negative tests, and monitor the repository and Symfony security advisories.
- Does the bundle hold on sub-requests, ESI fragments, and requests behind a proxy?
- You must verify this yourself because route-name and path matching can behave differently on sub-requests and ESI fragments. Behind a proxy, forwarded headers and trusted-proxy configuration can change the path, host, or scheme the matcher sees. Add explicit tests for these cases before relying on the restriction in production.
Weaver
How can I help you explore Laravel packages today?