Weave Code
Security Core Laravel Package
symfony/security-core
Symfony Security Core provides the foundation for authentication tokens, roles, voters, role hierarchies, and access decision management. Use it to build flexible authorization logic decoupled from user providers and integrate fine-grained access checks into apps.
Symfony Security Component - Core Library
Frequently asked questions about Security Core
- Can I use symfony/security-core to replace Laravel’s Auth facade entirely?
- No, a full replacement is complex due to Laravel’s deep integration with guards, middleware, and session handling. Instead, use it for authorization (voters) while keeping Laravel’s Auth facade for user management. For a hybrid approach, create middleware to bridge Symfony tokens and Laravel’s Auth::user().
- How do I integrate Symfony’s RoleHierarchy with Laravel’s gates/policies?
- Wrap Symfony’s RoleHierarchyVoter in a custom voter or middleware, then use it alongside Laravel’s gates. For example, create a `SymfonyRoleVoter` that checks roles via Symfony’s hierarchy before falling back to Laravel’s Gate::allows(). This avoids rewriting existing policy logic.
- Will symfony/security-core work with Laravel’s session driver (e.g., database or Redis)?
- Yes, but Symfony’s PersistentToken (for ‘remember me’) may conflict with Laravel’s session storage. Use Symfony’s token storage adapter to write tokens to Laravel’s session or database. Test edge cases like concurrent logins or session expiration.
- What’s the best way to test Symfony voters in a Laravel app?
- Mock Symfony’s AccessDecisionManager and voters in PHPUnit, then test decisions against Laravel’s User model. For integration tests, use Laravel’s HTTP tests to verify middleware or gates that delegate to Symfony voters. Focus on edge cases like role inheritance or token serialization.
- Does symfony/security-core support Laravel’s API token authentication (e.g., Sanctum or Passport)?
- Yes, but you’ll need to extend Symfony’s AbstractToken to handle API tokens. For example, create a `BearerToken` class that integrates with Sanctum’s token payload or Passport’s user resolver. Use Symfony’s AuthenticationTrustResolver to validate tokens before creating a Symfony token.
- How do I handle role hierarchies if Laravel already uses gates for admin checks?
- Replace or extend Laravel’s gates with Symfony’s RoleHierarchyVoter. For example, define `ROLE_ADMIN → ROLE_USER` in Symfony’s hierarchy, then use the voter in middleware or policies. This centralizes role logic while maintaining compatibility with existing gate checks.
- Are there performance concerns when using Symfony voters in high-traffic Laravel APIs?
- Yes, Symfony’s voters add indirection compared to Laravel’s direct gate calls. Benchmark your use case, especially for high-throughput APIs. Optimize by caching voter decisions or using Symfony’s `VoterInterface` to skip unnecessary checks.
- Can I use symfony/security-core in Laravel 9 (PHP 8.0) despite its PHP 8.1+ requirement?
- No, symfony/security-core requires PHP 8.1+. For Laravel 9, consider alternatives like spatie/laravel-permission or manually implement role hierarchies. If you must use Symfony, upgrade to Laravel 10+ or use a polyfill like `symfony/polyfill-php81` (though this may introduce compatibility risks).
- How do I migrate from Laravel’s policies to Symfony voters without breaking existing code?
- Create a hybrid system: wrap Symfony voters in Laravel policies or middleware. For example, in a policy’s `authorize()` method, delegate to Symfony’s AccessDecisionManager. Gradually replace policies with voters, starting with non-critical routes.
- What alternatives exist if symfony/security-core feels too complex for Laravel?
- For role-based access, try spatie/laravel-permission (simpler, Laravel-native). For fine-grained authorization, consider laravel-permission-manager or custom gates. If you need voter-like logic, extend Laravel’s Gate with middleware or traits. Symfony’s core is powerful but overkill for basic auth needs.
Weaver
How can I help you explore Laravel packages today?