Symfony2：安全/安全登录和注销

Question

我应该添加什么来处理安全和安全的登录和注销？

对于登录我从数据库中简单地获取和验证的信息，然后我设置会话和饼干：

if ($users) { //$users - fetched array of users 
    foreach ($users as $user) { 
     $response->headers->setCookie(new Cookie('user', $cookie, $expire, $path = '/', $domain = '', $secure = false, $httpOnly = false)); 
     $response->sendHeaders(); 

     foreach ($user as $key => $value) { 
      //setting every user information to session except password 
      $session->set($key, $value); 
     } 
    } 
} 

而对于注销我只是删除会话和饼干：

$response->headers->clearCookie('user'); 
$response->sendHeaders(); 

$request->getSession()->invalidate(); 

“用户'我设置为Cookie的值由以下项生成：

$password = $user['password']; //is already in md5 
$username = $user['email']; 
$cookie = base64_encode ("$username:" . md5 ($password)); 

所有这些都存储到主控制器。

Answer 1

这实在不是登录和注销实施的好方法。看看Symfony2安全教程。使用UserProvider从数据库中获取用户，并在成功时设置安全令牌。

一开始 - http://symfony.com/doc/current/cookbook/security/custom_provider.html

MD5函数不再安全。如果你愿意，可以使用比密码更强的密码和salt。

Answer 2

如果您按照Symfony cookbook中所述实施用户提供商和存储库，则可以按照这种方式以编程方式登录和注销用户。

下面是一个示例实现：

登录：

$username = $user['email']; 
$password = $user['password']; // NOTE: must be plain-text at this point 

$User = $this->container->get('doctrine')->getManager() 
    ->getRepository('TixysBackendBundle:User') 
    ->findOneBy(array('login' => $username)); 

if (!$User) throw \Exception("User not found!"); 

$factory = $this->container->get('security.encoder_factory'); 
$encoder = $factory->getEncoder($User); 
$password = $encoder->encodePassword($password, $User->getSalt()); 

if ($password != $User->getPassword()) 
    throw new \Exception("Wrong password."); 

// actual login 
$token = new UsernamePasswordToken($User, null, 'secured_area', $User->getRoles()); 
$this->container->get('security.context')->setToken($token); 

注销：

$this->container->get('security.context')->setToken(null); 
$this->container->get('session')->invalidate(); 

// If you've stored an instance of the previously authenticated user 
// somewhere, destroy that instance, too. 

你并不需要关心的实际哈希算法这一点，鉴于您在app/config/security.yml中的设置已正确完成。