Implement your own SecurityController

I recently wrote an article for my company on managing users and their authentication natively using the Symfony2 Core, and therefore without FOSUserBundle. Following this already rich first article, I wanted to describe a second equally useful part which will allow us to quickly set up the essential functions, namely, resetting your password, changing your password, validating your account or even register. Actions just as essential when you have a system managing users.

Set up a SecurityController

First, if you haven't followed the first tutorial on how to set up user management, I advise you to take a look. If you followed the solution, you should logically have a SecurityController or something else. In my case, I only have three methods, only one of which is really usable.

1. loginAction
   This method connects a user.
2. checkAction
   This method simply allows you to declare a route for the firewall, allowing a user to connect on the server side.
3. logoutAction
   This method is used to declare a route for the firewall allowing a user to be disconnected.

Open our platform to new users

It would be particularly interesting if our users could connect, and therefore be able to register beforehand.

First, we generate the form with the information you want to ask your user.

Regarding the form you will use to register your user, know that the field " Password should not be in your form. However, you will need to add two fields " not mapped in order to have the desired password entered twice.

Then, it's when your user comes back with his form filled out that we'll have to register him or reject his file :p

Here we will quickly detail the workflow to register a new user.

1. We look if all the required fields are entered correctly, including the two "password" fields, and if the latter two are identical.
2. We encode the password and we “set” it in the entity.
3. In case of any error, we return the form with the error that we think should be detailed.

Create a feature to reset your password

Now your user can log in but what will we do if he loses his password. It is obvious that we are not going to set up a contact email address dedicated to its useless operations.

As you have seen above, I usually declare two methods for each of my functionalities: one of my methods is responsible for managing the view created following a request GET and a result of a request POST. You can absolutely concatenate these two methods into one and the same method.

In a second step, we will declare the complementary method managing the requests POST.

This method was designed to reset the password of a user who provided his login/username. In my case, the password was then sent by email. I'll let you add that gallant line.

1. So we're going search user.
2. We generate a password that we come to inform in the user once he has encoded according to the rules that you have defined.

Set up password change

At this point, our user can generate a new password if it was lost, but in case he just wants to change it, we need a gate to define a gate.

Here is the code to generate the view. First, you will have to enter your old password, then enter your new password twice. The second time being confirmation.

Now we will see the code to resetter the password. THE to process is similar to generating a new random password.

If you take 1 minute to read the code, you will see that this one is particularly simple.

1. First, we check if the three fields (old password, new password and confirmation) have been entered correctly.
2. On enter the password current and we compare it with the current passwordment in the database to see if it corresponds with the old password entered.
3. We check if the "two" new passwords are identical.
4. Enter the new password and push in the entity.

Activation of his account

This feature is not detailed perfectly in other snippets above. Its purpose is to unblock a user who has just registered, when he has validated his email for example. This functionality is developed on almost all the platforms we know for several reasons. To set up a blocking of a user, you might also need to implement a provider.

• Block/limit accounts fake and spam.
• Vérifier that the user has filled in an e-mail address that appears usable at first sight.
• Remove accounts that have not been validated after a certain period of time.

Workflow

1. A user registers. His account is then blocked via a field specific to you. This field should then prevent him from connecting as long as this field indicates that the account is disabled.

1. The user received an email when his profile was flush in database. This email must be part of an address that you generate.
   In this road, a token or unique identifier must be given allowing the user concerned to be found. I advise you to use a UUID4 which is intended to be random. You can find the list of UUIDs as well as the description of all versions.

You should have a URL like this.

1. The user opens his email and tries to activate his account by clicking on the link provided. We then enter the process below.

With this process you should have no problem enabling user account validation in place.

You can find this equivalent code on this Gist.