Weave Code
Security Http Laravel Package
symfony/security-http
Symfony Security HTTP integrates the Security Core component into HTTP applications, letting you secure parts of your app with firewalls and authenticate visitors through configurable authenticators. It bridges security policies and incoming requests.
Symfony Security Component - HTTP Integration
Frequently asked questions about Security Http
- How do I install symfony/security-http in a Laravel project?
- Install it with Composer using composer require symfony/security-http, but do not expect Laravel to consume it natively. You need a Laravel facade or middleware adapter that delegates authentication to Symfony's AuthenticatorManager. Pin a stable 8.1.x release such as 8.1.8 or newer and verify the constraint in your Composer file.
- Can I use Symfony Security HTTP firewalls in Laravel instead of Laravel middleware?
- Symfony firewalls are kernel-level constructs, so they are not a direct drop-in replacement for Laravel middleware. In Laravel you emulate them with middleware groups such as web and api, plus custom middleware that delegates to Symfony's authenticator system. Use priority-based middleware ordering and a decorator pattern to avoid conflicts with Laravel's pipeline.
- How does symfony/security-http integrate with Laravel's authentication providers?
- Wrap Laravel's UserProvider behind Symfony's UserProviderInterface so the security component can resolve users consistently. OAuth, JWT, LDAP, OIDC, and similar flows generally require custom adapters, for example using league/oauth2-client. Keep the integration behind a Laravel-compatible facade rather than exposing Symfony internals throughout the app.
- Which Laravel version is compatible with symfony/security-http 8.1?
- There is no simple Laravel version matrix because symfony/security-http is a standalone Symfony component integrated through adapters. Compatibility depends on your PHP and Symfony constraints, your Laravel facade, and how you wire the AuthenticatorManager into middleware. Pin 8.1.x at 8.1.8 or newer and test the integration against your target Laravel release.
- How do I configure form login or HTTP basic authentication in Laravel with Symfony Security HTTP?
- Configure Symfony's built-in form login or HTTP basic authenticators through your Laravel facade and delegate requests into the AuthenticatorManager. You also need authentication entry points so unauthenticated users receive the correct redirect or challenge response. Map Symfony's success and failure handling back into Laravel responses and session behavior.
- Is symfony/security-http a good alternative to Laravel Fortify and Sanctum for OAuth, LDAP, or OIDC?
- Laravel's default stack uses Fortify and Sanctum, while Symfony Security HTTP offers finer-grained authentication flows and authenticators. It can be useful when you need OAuth, CAS, LDAP, JWT, or OIDC behavior that is not native to Laravel's default stack. The tradeoff is added complexity, so abstract Symfony's logic behind a Laravel-compatible facade.
- What security fixes should I verify after the symfony/security-http 5.4.54 release?
- Version 5.4.54 is on the legacy 5.4 LTS line and is not the 8.1.x upgrade target, but it contains security fixes that may share code paths with 8.1.x. The relevant areas are PersistentRememberMeHandler, the login-link handler, and session-token logging. Confirm the equivalent fixes are present in your pinned 8.1.x build rather than assuming cross-branch propagation.
- Does symfony/security-http 8.1.8 fix OIDC key confusion in multi-IdP Laravel apps?
- Version 8.1.8 includes the OIDC hardening that binds discovered keys to their issuers, which closes a key-confusion class of weakness. For multi-IdP Laravel deployments this is a meaningful hardening step, so pin symfony/security-http at 8.1.8 or newer. Continue validating issuer and key configuration in your own integration.
- How do I test Symfony Security HTTP authentication in a Laravel application?
- Test the Laravel facade and middleware delegation rather than assuming Symfony firewalls behave exactly like Laravel auth middleware. Cover access control rules, authentication entry points, successful and failed authenticator flows, and CSRF and session handling. Feature tests should assert both the response behavior and the user identity resolved through Symfony's security system.
- What production risks come with integrating Symfony Security HTTP into Laravel?
- The main risks are middleware conflicts, added authentication overhead, and mismatched CSRF or session handling between the two systems. Mitigate them with explicit middleware ordering, a decorator or facade around Symfony's AuthenticatorManager, and focused integration tests. Also verify security patch coverage in your pinned 8.1.x build, especially session-token logging and any authenticator features you actually enable.
Weaver
How can I help you explore Laravel packages today?