Weave Code
Security Core Laravel Package
symfony/security-core
Symfony Security Core provides the core building blocks for authentication and authorization: tokens, voters, role hierarchies, access decision management, and user providers. Use it to implement flexible permission checks and separate security logic from user storage.
Symfony Security Component - Core Library
Frequently asked questions about Security Core
- How do I replace Laravel’s Auth::attempt() with Symfony Security Core?
- Symfony Security Core doesn’t directly replace `Auth::attempt()`. Instead, create a custom `AuthenticationProvider` and use the `AuthenticationManager` to handle token generation and authentication. Wrap this in a Laravel service or facade (e.g., `SymfonyAuth::attempt()`) to mimic Laravel’s syntax while leveraging Symfony’s underlying logic.
- Can I use Symfony Security Core for JWT authentication in Laravel APIs?
- Yes, but you’ll need to implement a custom `BearerToken` and integrate it with Symfony’s `AuthenticationManager`. For stateless APIs, pair it with a `PersistentToken` storage solution (e.g., Redis or DynamoDB) to manage token revocation. Laravel’s Passport or Sanctum can coexist if you use a hybrid approach for authorization.
- What’s the performance impact of role hierarchies in high-traffic Laravel apps?
- Role hierarchies add minimal overhead (~5–10ms per request) but can compound in nested checks. Benchmark your use case, especially for APIs. For high-traffic apps, cache `AccessDecisionManager` instances or use simpler `RoleVoter` configurations where possible. Symfony’s `RoleHierarchy` is optimized but not as lightweight as Laravel’s `Gate` system.
- How do I migrate from Laravel’s Gate/Policy to Symfony’s Voters?
- Replace `Gate::forUser()` with Symfony’s `AuthorizationChecker` and create custom `Voter` classes (e.g., `DepartmentVoter` for ABAC). Use `AccessDecisionManager` to combine voters. For incremental migration, keep Laravel’s `Policy` classes for simple checks and offload complex logic to Symfony Voters. Test edge cases like nested roles or dynamic attributes.
- Does Symfony Security Core support multi-tenancy in Laravel?
- Yes, but you’ll need to configure voters to accept tenant-specific data. Pass tenant IDs via `VoteObject`’s `extraData` or middleware, then use custom voters (e.g., `TenantVoter`) to enforce rules like `user.tenantId === request.tenantId`. Combine with Symfony’s `RoleHierarchy` for tenant-aware role inheritance (e.g., `ROLE_TENANT_ADMIN`).
- How do I integrate Symfony Security Core with Laravel’s middleware stack?
- Use Symfony’s `AuthenticatorInterface` and wrap it in Laravel middleware (e.g., `HandleAuthenticator`). For example, create a middleware that instantiates a `BearerTokenAuthenticator` and delegates to Symfony’s `AuthenticationManager`. This allows seamless HTTP integration while leveraging Symfony’s stateless/authenticator patterns.
- What Laravel versions are compatible with Symfony Security Core?
- Symfony Security Core requires PHP 8.4+, which aligns with Laravel 10+. For Laravel 9.x, use Symfony 6.x (PHP 8.1+). Avoid mixing versions—ensure your Laravel app’s dependencies (e.g., `symfony/http-foundation`) match the Security Core version. Check the [Symfony docs](https://symfony.com/doc/current/components/security.html) for version-specific quirks.
- How do I handle legacy Laravel auth (e.g., Passport) alongside Symfony Security Core?
- Use a hybrid approach: keep Passport for OAuth2/JWT auth and replace Laravel’s `Gate`/`Policy` with Symfony’s `AuthorizationChecker` and `Voter`. For token validation, implement a custom `AuthenticationProvider` that delegates to Passport’s `TokenGuard`. This avoids full migration while adopting Symfony’s authorization features incrementally.
- Are there Laravel-specific wrappers or packages to simplify Symfony Security Core integration?
- No official Laravel wrappers exist, but you can create custom facades (e.g., `SymfonyAuth`, `SymfonyGate`) to abstract Symfony’s classes. For example, wrap `AccessDecisionManager` in a `SymfonyAuthorization` facade to mimic Laravel’s `Gate` syntax. Community packages like `spatie/laravel-symfony-security` may emerge—check Packagist for updates.
- How do I log access decisions for audit compliance (e.g., GDPR/HIPAA)?
- Symfony’s `AccessDecisionManager` doesn’t log by default, but you can intercept decisions by extending it or using a custom `Voter` that logs via Laravel’s `Log` facade. For real-time audits, attach a listener to Symfony’s `security.access_decision` event (if available) or wrap `decide()` calls in middleware. Store logs in a structured format (e.g., JSON) for compliance.
Weaver
How can I help you explore Laravel packages today?