Security Http Laravel Package

Technical Evaluation

Architecture Fit

• Symfony Security HTTP is a standalone component of the Symfony ecosystem, designed to integrate with the Symfony Security Core component. It provides firewall-based security, authentication mechanisms, and authorization logic for HTTP applications.
• Laravel Compatibility: While Laravel uses Laravel Fortify and Laravel Sanctum for authentication, Symfony’s security-http offers fine-grained control over authentication flows (e.g., OAuth, CAS, LDAP, JWT) that may not be natively available in Laravel’s default stack.
• Key Features:
  • Firewall-based security (e.g., route-based access control).
  • Multiple authenticator support (form, OAuth, HTTP Basic, etc.).
  • Attribute-based authorization (#[IsGranted], #[CurrentUser]).
  • CSRF, logout, and session management.
  • OIDC, JWT, and token-based authentication.

Integration Feasibility

• Laravel’s Middleware System: Symfony’s security-http relies on kernel-level middleware (firewalls), which can be emulated in Laravel using:
  • Middleware groups (e.g., web, api).
  • Custom middleware (e.g., AuthenticateMiddleware, CsrfTokenMiddleware).
  • Laravel’s auth middleware can be extended to delegate to Symfony’s AuthenticatorManager.
• Authentication Providers:
  • Laravel’s UserProvider can be wrapped to integrate with Symfony’s UserProviderInterface.
  • OAuth, JWT, and LDAP integrations would require custom adapters (e.g., using league/oauth2-client for OAuth).
• Authorization:
  • Symfony’s attribute-based access control (#[IsGranted]) can be mapped to Laravel’s policy system or custom middleware.

Technical Risk

Key Questions for TPM

1. Why Symfony Security over Laravel’s Native Auth?
   • Is this for enterprise-grade auth (e.g., SAML, CAS, multi-factor) not covered by Laravel?
   • Does the team have Symfony expertise to maintain custom integrations?
2. Middleware vs. Kernel-Level Security
   • Should we replace Laravel’s auth middleware entirely or coexist with Symfony’s firewalls?
3. Session vs. Stateless Auth
   • Will this support API-first (JWT/OAuth) or session-based auth? (Symfony handles both.)
4. Testing & Debugging
   • How will we mock Symfony’s AuthenticatorManager in Laravel’s test suite?
5. Long-Term Maintenance
   • Who will handle Symfony security updates (e.g., CVE patches) in a Laravel codebase?

Integration Approach

Stack Fit

Migration Path

1. Phase 1: Authentication Layer

   • Replace Laravel’s AuthenticatesUsers trait with a Symfony Authenticator.
   • Example:

     use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
     use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
     
     class LaravelSymfonyAuthenticator extends AbstractAuthenticator {
         public function supports(Request $request): ?bool {
             return $request->isMethod('POST') && $request->request->has('_symfony_token');
         }
     
         public function authenticate(Request $request): Passport {
             $credentials = $request->request->all();
             $user = LaravelUserProvider::findByCredentials($credentials);
             return new Passport(new UserToken($user), ['ROLE_USER']);
         }
     }
     

   • Hook into Laravel’s auth.attempt to trigger Symfony’s authenticator.

2. Phase 2: Authorization Layer

   • Create a Laravel policy decorator that checks Symfony’s AccessControlList.
   • Example:

     use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
     
     class SymfonyPolicyDecorator implements CanAuthorize {
         public function authorize(Request $request, $ability, $model) {
             return $this->authorizationChecker->isGranted($ability, $model);
         }
     }
     

3. Phase 3: Firewall & Middleware

   • Register Symfony’s FirewallMap in Laravel’s Kernel.php:

     protected function registerFirewalls(): array {
         return [
             'api' => [
                 new Firewall('api', [
                     new FormLoginAuthenticator(),
                     new CsrfTokenManager(),
                 ]),
             ],
         ];
     }
     

   • Use Laravel’s middlewareGroups to route requests to Symfony’s firewalls.

Compatibility

Sequencing

1. Proof of Concept (PoC)
   • Implement single authenticator (e.g., form login) in a new Laravel module.
   • Test with Symfony’s DebugListener for auth events.
2. Incremental Rollout
   • Step 1: Replace form auth → Symfony FormLoginAuthenticator.
   • Step 2: Add OAuth/JWT via Symfony’s OidcAuthenticator.
   • Step 3: Migrate policies to #[IsGranted] attributes.
3. Full Cutover
   • Deprecate Laravel’s AuthManager in favor of Symfony’s AuthenticatorManager.
   • Update CSRF, logout, and session handling to use Symfony’s components.

Operational Impact

Maintenance