Remember me, password reset, email verification

A login form is only the start. A real site has to remember a user between visits, defend against password guessing, verify the email address and recover a forgotten password. In Symfony almost all of it is turned on by configuration or a ready-made package.

Remember me

# config/packages/security.yaml
security:
    firewalls:
        main:
            remember_me:
                secret: '%kernel.secret%'
                lifetime: 604800

Add a checkbox named _remember_me to the login form:

<label>
    <input type="checkbox" name="_remember_me"> Remember me
</label>

The user stays logged in for a week (604800 seconds), even after closing the browser.

A full login for important actions

A login through the remember-me cookie is weaker than one with a password: someone else may have used the laptop. Changing a password or paying requires a full login:

#[Route('/account/password', name: 'account_password')]
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function changePassword(): Response
{
    // …
}

Login throttling

composer require symfony/rate-limiter

security:
    firewalls:
        main:
            login_throttling:
                max_attempts: 5
                interval: '15 minutes'

After five failed attempts, login from that address and for that name is blocked for 15 minutes.

Email verification

composer require symfonycasts/verify-email-bundle
php bin/console make:registration-form

Answer "yes" to the question about email verification: the command creates the sending of an email with a link and the route that checks it. The link is signed, so it cannot be forged.

Password reset

composer require symfonycasts/reset-password-bundle
php bin/console make:reset-password

You get the "Forgot your password?" pages, an email with a link and a new-password form. The link is valid for a limited time and works once.

Impersonating a user

To see the site through a user's eyes, an administrator does not need their password:

security:
    firewalls:
        main:
            switch_user: true

The address /profile?_switch_user=anna@example.com switches to the user, and ?_switch_user=_exit switches back. The ROLE_ALLOWED_TO_SWITCH role grants the right.

Logout

security:
    firewalls:
        main:
            logout:
                path: app_logout
                target: home

Common mistake

The "Forgot your password?" page must not reveal whether an address is registered: the phrase "No such email" lets someone compile a list of users. Answer the same in both cases — "If the address is registered, we have sent an email". The reset-password-bundle package behaves exactly like that.