Weave Code
Security Bundle Laravel Package
symfony/security-bundle
SecurityBundle tightly integrates Symfony's Security component into the full-stack framework, giving you configuration-driven authentication, authorization, firewalls, access control and user providers without wiring the services by hand.
Provides a tight integration of the Security component into the Symfony full-stack framework
Frequently asked questions about Security Bundle
- What is symfony/security-bundle used for?
- SecurityBundle wires Symfony's Security component into the full-stack framework so you can define authentication, authorization, firewalls, access control rules and user providers through configuration instead of manual service wiring. It is the standard integration layer for Symfony applications that need form login, HTTP basic auth, remember-me, voters or custom authenticators. In a Laravel context it is not a native auth package and would have to run as a separate or well-bounded Symfony service.
- Can I use symfony/security-bundle in a Laravel application?
- Only with significant custom work. The bundle expects Symfony firewalls, providers, voters and its own session and CSRF flows, so integrating it into Laravel requires bridges for user providers, middleware-to-firewall mapping, session handling and Doctrine-versus-Eloquent adaptation. Most Laravel teams are better served by native auth, Sanctum or spatie/laravel-permission unless enterprise requirements such as complex RBAC, CAS, OIDC or a legacy Symfony migration justify it. If you do use it, isolate it as an authentication service rather than an embedded dependency.
- How do I install symfony/security-bundle with Composer?
- Run composer require symfony/security-bundle in a Symfony application and make sure the bundle is enabled in your kernel or bundles configuration, then define your firewalls and providers in config/packages/security.yaml. In a Laravel project the same Composer install will pull in Symfony components that can conflict with existing framework constraints, so plan dependency resolution carefully. After installing, clear the cache and verify that security services and routing load correctly before writing any auth rules.
- Which Symfony versions does symfony/security-bundle support, and should I target 5.4 or 8.x?
- Support depends on the branch: 5.4 is the long-term maintenance line and receives security patches such as v5.4.54, while 8.x releases include newer features and configuration deprecations. Confirm which branch your production application actually runs before planning an upgrade, because the fixes and configuration syntax differ between lines. Applying a 5.4 patch to an 8.x codebase, or assuming equivalent fixes exist in a beta, is not safe without verification.
- How do I configure firewalls and user providers in security.yaml?
- You declare a firewall per entry point (for example main or api), attach authenticators such as form_login or json_login, and point the firewall at a user provider that loads users from your storage layer. Access control entries then map URL patterns to roles, and voters handle finer-grained authorization decisions. Keep provider and firewall definitions explicit and test each entry point separately, since misconfigured firewalls can silently expose routes.
- What changed in symfony/security-bundle v5.4.54?
- This is a maintenance and security release on the 5.4 branch with no documented new features, deprecations or breaking changes. It hardens two behaviors: redirects are restricted to the current host when sessions are disabled, and login throttling uses a lock by default. If you run Symfony Security 5.4 in production, treat this as a priority patch and regression-test redirects and throttling afterward.
- Does login throttling now require a lock backend?
- In v5.4.54 login throttling uses a lock by default, so you need a working and performant lock backend in production. A missing, misconfigured or contended lock store can affect login availability rather than just throttling accuracy. Configure the lock component explicitly, load-test it under realistic login volume, and confirm behavior in multi-server deployments before rollout.
- Why do cross-host redirects stop working when sessions are disabled?
- The v5.4.54 hardening restricts redirects to the current host when sessions are disabled, which intentionally blocks redirects to other hosts in those flows. Session-disabled authentication paths such as SSO callbacks or load-balanced multi-host deployments may depend on cross-host redirects and can break after upgrading. Test those flows explicitly and adjust your redirect targets or architecture if cross-host behavior is required.
- Is symfony/security-bundle a good alternative to Laravel Sanctum or spatie/laravel-permission?
- Usually not for a standard Laravel application. Sanctum and spatie/laravel-permission integrate directly with Eloquent, middleware, Blade and Laravel's session and CSRF handling, while SecurityBundle assumes Symfony's firewall and provider model. Symfony Security is reasonable only when you need capabilities that justify the added complexity, such as advanced RBAC, CAS or OIDC integration, or when migrating a legacy Symfony auth layer. Even then, prefer running it as an isolated authentication service.
- How should I test authentication after upgrading symfony/security-bundle?
- Run full auth regression tests covering login, logout, throttling, CSRF and redirect behavior on every entry point. Add specific cases for session-disabled redirects if you use SSO or run behind multiple hosts, and load-test the lock backend used by login throttling. Also confirm your deployed Symfony branch and Composer constraints match the patched version you are installing before releasing to production.
Weaver
How can I help you explore Laravel packages today?