Symfony 6: User Authentication

$ php composer create-project \      symfony/website-skeleton "."$ php composer require \      symfony/orm-pack \      symfony/serializer$ php composer require --dev \      symfony/maker-bundle

$ composer require symfony/security-bundle

$ php bin/console make:user

The name of the security user class (e.g. User) [User]: >  Do you want to store user data in the database (via Doctrine)? (yes/no) [yes]: >  Enter a property name that will be the unique "display" name for the user (e.g. email, username, uuid) [email]: >  Will this app need to hash/check user passwords? Choose No if passwords are not needed or will be checked/hashed by some other system (e.g. a single sign-on server). Does this app need to hash/check user passwords? (yes/no) [yes]: >  created: src/Entity/User.php created: src/Repository/UserRepository.php updated: src/Entity/User.php updated: config/packages/security.yaml  Success!  Next Steps:   - Review your new App\Entity\User class.   - Use make:entity to add more fields to your User entity and then run make:migration.   - Create a way to authenticate! See https://symfony.com/doc/current/security.html

$ php bin/console make:migration$ php bin/console doctrine:migrations:migrate

$ php bin/console make:registration-form

 Creating a registration form for App\Entity\User Do you want to add a @UniqueEntity validation annotation on your User class to make sure duplicate accounts aren't created? (yes/no) [yes]: > 

 Do you want to send an email to verify the user's email address after registration? (yes/no) [yes]: >  [WARNING] We're missing some important components. Don't forget to install these after you're finished.                           composer require symfonycasts/verify-email-bundle                                                            

 By default, users are required to be authenticated when they click the verification link that is emailed to them. This prevents the user from registering on their laptop, then clicking the link on their phone, without having to log in. To allow multi device email verification, we can embed a user id in the verification link. Would you like to include the user id in the verification link to allow anonymous email verification? (yes/no) [no]: >     What email address will be used to send registration confirmations? (e.g. [email protected]): > mailer@(your-domain) What "name" should be associated with that email address? (e.g. Acme Mail Bot): > Acme Mail Bot Do you want to automatically authenticate the user after registration? (yes/no) [yes]: >  ! [NOTE] No Guard authenticators found - so your user won't be automatically authenticated after registering.           What route should the user be redirected to after registration?:  [0 ] _preview_error  [1 ] _wdt  [2 ] _profiler_home  [3 ] _profiler_search  [4 ] _profiler_search_bar  [5 ] _profiler_phpinfo  [6 ] _profiler_xdebug  [7 ] _profiler_search_results  [8 ] _profiler_open_file  [9 ] _profiler  [10] _profiler_router  [11] _profiler_exception  [12] _profiler_exception_css  [13] app_app > 13 updated: src/Entity/User.php updated: src/Entity/User.php created: src/Security/EmailVerifier.php created: templates/registration/confirmation_email.html.twig created: src/Form/RegistrationFormType.php created: src/Controller/RegistrationController.php created: templates/registration/register.html.twig  Success!  Next: 1) Install some missing packages:      composer require symfonycasts/verify-email-bundle 2) In RegistrationController::verifyUserEmail():    * Customize the last redirectToRoute() after a successful email verification.    * Make sure you're rendering success flash messages or change the $this->addFlash() line. 3) Review and customize the form, controller, and templates as needed. 4) Run "php bin/console make:migration" to generate a migration for the newly added User::isVerified property. Then open your browser, go to "/register" and enjoy your new form!

$ composer require symfonycasts/verify-email-bundle

Info from https://repo.packagist.org: #StandWithUkraineUsing version ^1.12 for symfonycasts/verify-email-bundle./composer.json has been updatedRunning composer update symfonycasts/verify-email-bundleLoading composer repositories with package informationUpdating dependenciesLock file operations: 1 install, 0 updates, 0 removals  - Locking symfonycasts/verify-email-bundle (v1.12.0)Writing lock fileInstalling dependencies from lock file (including require-dev)Package operations: 1 install, 0 updates, 0 removals  - Downloading symfonycasts/verify-email-bundle (v1.12.0)  - Installing symfonycasts/verify-email-bundle (v1.12.0): Extracting archiveGenerating optimized autoload files109 packages you are using are looking for funding.Use the `composer fund` command to find out more!Symfony operations: 1 recipe (c63cd854aac79ffae347ea7cceaa2e44)  - Configuring symfonycasts/verify-email-bundle (>=v1.12.0): From auto-generated recipeExecuting script cache:clear [OK]Executing script assets:install public [OK] What's next? Some files have been created and/or updated to configure your new packages.Please review, edit and commit them: these files are yours.No security vulnerability advisories found

$ php bin/console make:migration$ php bin/console doctrine:migrations:migrate

  ###> symfony/mailer ###- # MAILER_DSN=null://null+ MAILER_DSN=null://null  ###< symfony/mailer ###

$ php bin/console make:controller Auth

 created: src/Controller/AuthController.php created: templates/auth/index.html.twig  Success!  Next: Open your new controller class and add some pages!

$ mv templates/auth/index.html.twig templates/auth/sign-in.html.twig

  {% block body %}- # all !!+ {% if error %}+     <div>{{ error.messageKey|trans(error.messageData, 'security') }}</div>+ {% endif %}+ + <form action="{{ path('app_sign_in') }}" method="post">+     <label for="username">Email:</label>+     <input type="text" id="username" name="_username" value="{{ last_username }}"/>+ +     <label for="password">Password:</label>+     <input type="password" id="password" name="_password"/>+ +     {# If you want to control the URL the user is redirected to on success+     <input type="hidden" name="_target_path" value="/account"/> #}+ +     <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">+ +     <button type="submit">login</button>+ </form>  {% endblock %}

  security:      # ...      firewalls:          # ...          main:              # ...+             form_login:+                 login_path: app_sign_in+                 check_path: app_sign_in+                 enable_csrf: true+             logout:+                 path: app_sign_out

+ use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;  # ...  class AuthController extends AbstractController  {-     #[Route('/auth', name: 'app_auth')]-     public function index(): Response-     {-         return $this->render('auth/index.html.twig', [-             'controller_name' => 'AuthController',-         ]);-     }+     #[Route('/sign-in', name: 'app_sign_in')]+     public function app_sign_in(AuthenticationUtils $authenticationUtils): Response+     {+         // get the login error if there is one+         $error = $authenticationUtils->getLastAuthenticationError();+ +         // last username entered by the user+         $lastUsername = $authenticationUtils->getLastUsername();+ +         return $this->render('auth/sign-in.html.twig', [+             'last_username' => $lastUsername,+             'error'         => $error,+         ]);+     }+ +     #[Route('/sign-out', name: 'app_sign_out')]+     public function app_sign_out(): Response+     {+         // controller can be blank: it will never be called!+         throw new \Exception('Don\'t forget to activate logout in security.yaml');+     }  }

  security:      # ...      firewalls:          # ...-         form_login:-             login_path: app_sign_in-             check_path: app_sign_in-             enable_csrf: true+         # form_login:+             # login_path: app_sign_in+             # check_path: app_sign_in+             # enable_csrf: true      # ...      access_control:          # ...+         - { path: ^/app, roles: ROLE_USER }

  security:      # ...      firewalls:          # ...-         # form_login:-             # login_path: app_sign_in-             # check_path: app_sign_in-             # enable_csrf: true+         form_login:+             login_path: app_sign_in+             check_path: app_sign_in+             enable_csrf: true