Security Http Laravel Package

Product Decisions This Supports

• Build vs. Buy: Buy – Leverages Symfony’s battle-tested security framework to avoid reinventing authentication/authorization logic, reducing technical debt and security risks.
• Feature Roadmap:
  • Multi-factor authentication (MFA): Integrate with OIDC, OAuth, or custom authenticators via firewalls.
  • Role-based access control (RBAC): Secure routes/endpoints with granular permissions (e.g., #[IsGranted('ROLE_ADMIN')]).
  • Stateless APIs: Replace session-based auth with token-based (JWT/OIDC) via #[IsCsrfTokenValid] or custom token handlers.
  • Impersonation/Proxy Users: Enable admin impersonation for debugging/support (e.g., security:impersonate).
  • Compliance: Simplify GDPR/CCPA by deprecating user FQCN in cookies (v8.0+) and supporting token revocation.
• Use Cases:
  • Legacy System Modernization: Migrate from custom auth to a standardized, maintainable framework.
  • Microservices: Secure inter-service communication with token-based authenticators.
  • SaaS Platforms: Role-based access for multi-tenant applications (e.g., #[CurrentUser] for tenant-specific data).
  • Headless APIs: Protect GraphQL/REST endpoints with stateless token validation.

When to Consider This Package

• Adopt if:

  • Your app uses Symfony (or Laravel with Symfony components) and needs HTTP-layer security (authentication/authorization).
  • You require firewall-based security (e.g., public vs. private routes, CSRF protection).
  • You’re integrating OIDC/OAuth (built-in support for discovery, token handling, and multi-provider setups).
  • You need extensible authenticators (e.g., form login, API tokens, magic links).
  • Your team prioritizes security best practices (e.g., deprecating FQCN in cookies, union types for #[CurrentUser]).

• Look elsewhere if:

  • You’re not using PHP/Symfony/Laravel (e.g., Node.js, Python, or custom stacks).
  • You need low-level cryptography (use symfony/security-core or libsodium directly).
  • Your auth is entirely stateless (e.g., pure JWT without sessions; consider lexik/jwt-authentication-bundle).
  • You require legacy protocol support (e.g., NTLM; Symfony’s focus is modern standards).
  • Your team lacks Symfony ecosystem familiarity (steep learning curve for custom firewall configurations).

How to Pitch It (Stakeholders)

For Executives: "Symfony’s security-http component lets us standardize authentication/authorization across our PHP stack—reducing vulnerabilities, cutting dev time, and enabling features like MFA/OIDC without custom code. It’s used by enterprises like backers and aligns with our roadmap for SaaS security and compliance. The MIT license and Symfony’s sponsorship ensure long-term support."

For Engineering: *"This replaces ad-hoc auth logic with a modular, firewall-driven system. Key wins:

• Firewalls: Secure routes dynamically (e.g., /admin → ROLE_ADMIN).
• Authenticators: Plug in form login, API tokens, or OIDC in hours (not weeks).
• Modern PHP: Supports attributes (#[IsGranted]) and union types for cleaner code.
• Compliance: Deprecates insecure patterns (e.g., FQCN in cookies) proactively. Tradeoff: Steeper initial setup than a simple auth package, but payoff is maintainability and security."*

For Developers: *"Ditch the spaghetti auth code. With security-http, you:

1. Configure firewalls in YAML/XML/PHP to protect routes.
2. Annotate controllers with #[IsGranted] or #[CurrentUser].
3. Extend authenticators for custom flows (e.g., magic links). Example: Secure an API endpoint:

#[IsGranted('ROLE_API_USER')]
public function sensitiveData(): Response { ... }

Docs: Symfony Security Component."*