Skip to content

[Security] use a consistent route name for the login form #16927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 4, 2022
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions security.rst
Original file line number Diff line number Diff line change
Expand Up @@ -683,7 +683,7 @@ First, create a controller for the login form:

class LoginController extends AbstractController
{
#[Route('/login', name: 'login')]
#[Route('/login', name: 'app_login')]
public function index(): Response
{
return $this->render('login/index.html.twig', [
Expand All @@ -706,9 +706,9 @@ Then, enable the form login authenticator using the ``form_login`` setting:
main:
# ...
form_login:
# "login" is the name of the route created previously
login_path: login
check_path: login
# "app_login" is the name of the route created previously
login_path: app_login
check_path: app_login

.. code-block:: xml

Expand All @@ -725,8 +725,8 @@ Then, enable the form login authenticator using the ``form_login`` setting:
<config>
<!-- ... -->
<firewall name="main">
<!-- "login" is the name of the route created previously -->
<form-login login-path="login" check-path="login"/>
<!-- "app_login" is the name of the route created previously -->
<form-login login-path="app_login" check-path="app_login"/>
</firewall>
</config>
</srv:container>
Expand All @@ -741,10 +741,10 @@ Then, enable the form login authenticator using the ``form_login`` setting:

$mainFirewall = $security->firewall('main');

// "login" is the name of the route created previously
// "app_login" is the name of the route created previously
$mainFirewall->formLogin()
->loginPath('login')
->checkPath('login')
->loginPath('app_login')
->checkPath('app_login')
;
};

Expand All @@ -767,7 +767,7 @@ Edit the login controller to render the login form:

class LoginController extends AbstractController
{
#[Route('/login', name: 'login')]
#[Route('/login', name: 'app_login')]
- public function index(): Response
+ public function index(AuthenticationUtils $authenticationUtils): Response
{
Expand Down Expand Up @@ -805,7 +805,7 @@ Finally, create or update the template:
<div>{{ error.messageKey|trans(error.messageData, 'security') }}</div>
{% endif %}

<form action="{{ path('login') }}" method="post">
<form action="{{ path('app_login') }}" method="post">
<label for="username">Email:</label>
<input type="text" id="username" name="_username" value="{{ last_username }}"/>

Expand All @@ -829,7 +829,7 @@ Finally, create or update the template:

The form can look like anything, but it usually follows some conventions:

* The ``<form>`` element sends a ``POST`` request to the ``login`` route, since
* The ``<form>`` element sends a ``POST`` request to the ``app_login`` route, since
that's what you configured as the ``check_path`` under the ``form_login`` key in
``security.yaml``;
* The username (or whatever your user's "identifier" is, like an email) field has
Expand Down Expand Up @@ -942,7 +942,7 @@ be ``authenticate``:
{# templates/login/index.html.twig #}

{# ... #}
<form action="{{ path('login') }}" method="post">
<form action="{{ path('app_login') }}" method="post">
{# ... the login fields #}

<input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
Expand Down