Symfony/Security for PHP: Complete Guide with Examples

Symfony/Security is a powerful and flexible component of the Symfony ecosystem, designed for implementing authentication and authorization in PHP applications. It provides developers with a ready-made architecture for protecting routes, managing sessions, working with passwords, and integrating with various user providers (database, LDAP, OAuth).

Why is this library needed? In modern web development, security is not an option but a mandatory requirement. Symfony/Security allows you to abstract away from routine tasks: password hashing, creating login forms, checking roles and tokens. Instead of reinventing the wheel, you get an industry standard used in thousands of projects worldwide. The component integrates easily both with the Symfony framework and with other PHP applications via the symfony/security-core package.

Main features include: support for multiple firewalls for different parts of the application, a flexible user provider system, automatic session and cookie management, as well as built-in protection against CSRF attacks and password brute-forcing. The library follows the "security by default" principle, making it an ideal choice for projects of any scale.

Installation

Installation is done via Composer, the standard package manager for PHP. Run the following command in your project root:

composer require symfony/security-bundle

If you are using Symfony Flex (recommended), the recipe will automatically configure the basic setup. For standalone projects (without a framework), install the core:

composer require symfony/security-core symfony/security-http symfony/security-csrf

Quick Start: Minimal Working Example

Let's create a simple protected page. First, make sure you have Symfony installed (version 6.4+). We'll create a controller and configure security.

Step 1: security.yaml Configuration

# config/packages/security.yaml\nsecurity:\n    enable_authenticator_manager: true\n    providers:\n        in_memory:\n            memory:\n                users:\n                    admin:\n                        password: '$2y$13$...' # hash of password "admin123"\n                        roles: ['ROLE_ADMIN']\n    firewalls:\n        main:\n            lazy: true\n            provider: in_memory\n            form_login:\n                login_path: login\n                check_path: login\n            logout:\n                path: /logout\n    access_control:\n        - { path: ^/admin, roles: ROLE_ADMIN }

Step 2: Controller

// src/Controller/SecurityController.php\nnamespace App\\Controller;\n\nuse Symfony\\Bundle\\FrameworkBundle\\Controller\\AbstractController;\nuse Symfony\\Component\\HttpFoundation\\Response;\nuse Symfony\\Component\\Routing\\Annotation\\Route;\nuse Symfony\\Component\\Security\\Http\\Authentication\\AuthenticationUtils;\n\nclass SecurityController extends AbstractController\n{\n    #[Route('/login', name: 'login')]\n    public function login(AuthenticationUtils $authenticationUtils): Response\n    {\n        $error = $authenticationUtils->getLastAuthenticationError();\n        $lastUsername = $authenticationUtils->getLastUsername();\n\n        return $this->render('security/login.html.twig', [\n            'last_username' => $lastUsername,\n            'error' => $error,\n        ]);\n    }\n\n    #[Route('/admin', name: 'admin')]\n    public function admin(): Response\n    {\n        $this->denyAccessUnlessGranted('ROLE_ADMIN');\n        return new Response('Welcome to the admin panel!');\n    }\n}

Step 3: Login Template (Twig)

  
Also in library
  

                
                  
                 OAuth Client for Java: ScribeJava and Spring Security OAuth2
      
                
                  
                 JSON Processing in JavaScript (Node.js): Complete Guide
      
                
                  
                 Machine Learning in Java: Overview of Libraries for Model Development
      
                
                  
                 PHP Task Scheduler: cron-like tasks without crond
      
                
                  
                 Vision for Swift: Complete Guide with Examples