techpaf/annotation-firewall-bundle

Symfony2 bundle

AnnotationFirewallBundle

This bundle allows you to configure firewalls using annotations for your Symfony2 Project. It is inspired by Matthias Noback's blog, the NelmioApiDocBundle and the JMSSerializerBundle., _(*1)

, _(*2)

Installation

Update your composer.json file:, _(*3)

``` JSON { "require": { "techpaf/annotation-firewall-bundle": "0.1.*@dev" } }, <sub>(*4)</sub>

Register the bundle in `app/AppKernel.php`:

``` PHP
// app/AppKernel.php
public function registerBundles()
{
    return array(
        // ...
        new TechPaf\AnnotationFirewallBundle\TechPafAnnotationFirewallBundle(),
    );
}

Usage

The AnnotationFirewallBundle uses annotations to indicate which Routes should be secured., <sub>(*5)</sub>

Security.yml

Instead of using a pattern like pattern: ^/api/ in your security.yml file, you need to register the request_matcher provided by the bundle., <sub>(*6)</sub>

``` YAML, <sub>(*7)</sub>

app/config/security.yml

...

firewalls: any_firewall: #pattern: ^/api/ # No need of the pattern anymore request_matcher: techpaf.annotation_firewall.annotation_request_matcher, <sub>(*8)</sub>

You can use it with multiple firewalls. For example:

``` YAML
firewalls:
    dev:          # default Firewall
        pattern:  ^/(_(profiler|wdt)|css|images|js)/
        security: false

    fos_secured:  # FOSUserBundle Firewall
        pattern: ^/admin/
        # ...

    wsse_secured: # MopaWSSEAuthenticationBundle Firewall
        request_matcher: techpaf.annotation_firewall.annotation_request_matcher
        # ...

Annotations

Then you need to configure each Controller you want to secure using this bundle., <sub>(*9)</sub>

``` PHP <?php, <sub>(*10)</sub>

namespace TechPaf\ExampleBundle\Controller;, <sub>(*11)</sub>

// ... use TechPaf\AnnotationFirewallBundle\Annotation\FirewallExclude; use TechPaf\AnnotationFirewallBundle\Annotation\FirewallExclusionPolicy;, <sub>(*12)</sub>

/** * @FirewallExclusionPolicy("NONE") */ class MyController extends Controller { /** * @Route("/secured") * @Template() **/ public function securedAction() { return array('secured' => true); }, <sub>(*13)</sub>

/**
* @Route("/not_secured")
* @Template()
*
* @FirewallExclude
**/
public function notSecuredAction()
{
    return array('secured' => false);
}

} ```, <sub>(*14)</sub>

There are three annotations: * @FirewallExclusionPolicy * @FirewallExclude * @FirewallExpose, <sub>(*15)</sub>

@FirewallExclusionPolicy

This annotation specify the default policy for every routes of a controller. It can have two values : ALL or NONE., <sub>(*16)</sub>

• ALL means that every route will be excluded from the firewall unless you add an @FirewallExpose annotation
• NONE means that every route will be added to the firewall unless you add an @FirewallExclude annotation

By default the exclusion policy is ALL, so unless you add annotations, no route will be secured using the AnnotationFirewallBundle., <sub>(*17)</sub>

@FirewallExclude

This annotation exclude a specific route from the firewall (the route is not secured), <sub>(*18)</sub>

@FirewallExpose

This annotation add a specific route to the firewall (the route is secured), <sub>(*19)</sub>

TODO

The next updates are going to be: * Allow usage of the AnnotationFirewallBundle in multiple firewalls simultaneously * Add Cache, <sub>(*20)</sub>