php - Silex登录成功后不直接

Question

我在使用 Silex 和安全服务时遇到了一点问题。

当用户在我的登录表单中(正确地)输入他的数据时，它不会被重定向到应用程序 url。他保持在同一个页面中，并且在登录表单页面中进行调试，安全提供程序中没有任何内容表明他已通过身份验证。但是，在“成功登录”之后，如果我直接在浏览器中输入 url，我就可以访问，因为我已经过身份验证。像这样的过程:

主页-> 登录检查(登录成功)-> 主页(未验证)->/app(已验证)

如果登录正常，我希望它直接重定向到/app，并理解为什么在我的主页上，即使在成功登录后，安全提供商仍然说我没有通过身份验证。

我正在编写以下代码:

index.php

<?php

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Validator\Constraints as Assert;

require_once __DIR__.'/../vendor/autoload.php';

$app = new Silex\Application();

/**
 * App Registrations & Debug Setting
 */

$app
    ->register(new Silex\Provider\TwigServiceProvider(), array('twig.path' => __DIR__.'/../views'))
    ->register(new Silex\Provider\UrlGeneratorServiceProvider())
    ->register(new Silex\Provider\SessionServiceProvider())
    ->register(new Silex\Provider\FormServiceProvider())
    ->register(new Silex\Provider\ValidatorServiceProvider())
    ->register(new Silex\Provider\TranslationServiceProvider(), array(
        'translator.messages' => array(),
    ))
    ->register(new Silex\Provider\DoctrineServiceProvider(), array(
        'db.options' => array(
            'driver'   => 'pdo_mysql',
            'dbname'   => 'pomodesk',
            'host'     => 'localhost',
            'user'     => 'root',
            'password' => 'root'
        )
    ))
    ->register(new Silex\Provider\SecurityServiceProvider(), array(
        'security.firewalls' => array(
            'app' => array(
                'pattern' => '^/app',
                'http' => true,
                'form' => array('login_path' => '/', 'check_path' => '/app/login_check'),
                'logout' => array('logout_path' => '/app/logout'),
                'anonymous' => false,
                'users' => $app->share(function () use ($app) {
                    return new Pomodesk\Provider\UserProvider($app['db']);
                })
            ),
        ),
        'security.access_rules' => array(
            array('^/app', 'ROLE_USER')
        )
    ));

$app['debug'] = true;

/**
 * App Routes
 */

$app->get('/', function(Request $request) use ($app) {

    $form = $app['form.factory']
        ->createBuilder('form')
        ->add('name', 'text')
        ->add('email', 'text')
        ->add('password', 'password')
        ->getForm();

    if ('POST' == $request->getMethod()) {
        $form->bind($request);

        $data = $form->getData();

        $constraint = new Assert\Collection(array(
            'name'     => array(new Assert\Length(array('min' => 5)), new Assert\NotBlank()),
            'email'    => new Assert\Email(),
            'password' => array(new Assert\Length(array('min' => 6)), new Assert\NotBlank())
        ));

        $errors = $app['validator']->validateValue($data, $constraint);

        $userProvider = new Pomodesk\Provider\UserProvider($app['db']);

        try {
            $duplicated = $userProvider->loadUserByUsername($data['email']);
        } catch (Exception $e) {
            $duplicated = false;
        }

        if ($form->isValid() && count($errors) < 1 && !$duplicated) {
            $user = new \Symfony\Component\Security\Core\User\User($data['email'], '', array('ROLE_USER'));

            $encoder = $app['security.encoder_factory']->getEncoder($user);

            $insertion = $app['db']->insert(
                'user',
                array(
                    'email'    => $data['email'],
                    'name'     => $data['name'],
                    'password' => $encoder->encodePassword($data['password'], $user->getSalt()),
                    'roles'    => 'ROLE_USER'
                )
            );

            return $app['twig']->render('home.html.twig', array(
                'username' => $data['email'],
                'signup'   => true
            ));
        }

        return $app['twig']->render('home.html.twig', array(
            'username' => $data['email'],
            'signup'   => true
        ));
    }

    return $app['twig']->render('home.html.twig', array(
        'error'         => $app['security.last_error']($request),
        'last_username' => $app['session']->get('_security.last_username'),
        'form'          => $form->createView()
    ));
})
->method('GET|POST')
->bind('home');

$app->get('/app', function() use ($app) {

    $app['app_js'] = $app['twig']->render('script.js.twig');
    $data = array();

    return $app['twig']->render('app.html.twig', $data);
})
->bind('app_home');

$app->run();

UserProvider.php

<?php

namespace Pomodesk\Provider;

use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\User;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
use Doctrine\DBAL\Connection;

class UserProvider implements UserProviderInterface
{
    private $conn;

    public function __construct(Connection $conn)
    {
        $this->conn = $conn;
    }

    public function loadUserByUsername($username)
    {
        $stmt = $this->conn->executeQuery('SELECT * FROM user WHERE email = ?', array(strtolower($username)));

        if (!$user = $stmt->fetch()) {
            throw new UsernameNotFoundException(sprintf('Email "%s" does not exist.', $username));
        }

        return new User($user['email'], $user['password'], explode(',', $user['roles']), true, true, true, true);
    }

    public function refreshUser(UserInterface $user)
    {
        if (!$user instanceof User) {
            throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user)));
        }

        return $this->loadUserByUsername($user->getUsername());
    }

    public function supportsClass($class)
    {
        return $class === 'Symfony\Component\Security\Core\User\User';
    }
}

非常感谢!

Answer 1

像这样更改您的代码:

  ->register(new Silex\Provider\SecurityServiceProvider(), array(
            'security.firewalls' => array(
                'app' => array(
                    'pattern' => '^/',
                    'http' => true,
                    'form' => array('login_path' => '/', 'check_path' => '/app/login_check'),
                    'logout' => array('logout_path' => '/app/logout'),
                    'anonymous' => true,
                    'users' => $app->share(function () use ($app) {
                        return new Pomodesk\Provider\UserProvider($app['db']);
                    })
                ),
            ),
            'security.access_rules' => array(
                array('^/app', 'ROLE_USER')
            )
        ));

在防火墙中允许匿名用户，并且只使用访问规则保护/app 路由。如果你不这样做，你就会遇到上下文问题，假设你想要一个自定义菜单，如果用户登录了你应用程序的所有页面，即使是那些不安全的页面，你也将无法做到这一点，如果您不会在所有网站上共享安全上下文。

根据 symfony 文档，这些是您可以在表单数组中使用的一些选项:

            # login success redirecting options (read further below)
            always_use_default_target_path: false
            default_target_path:            /
            target_path_parameter:          _target_path
            use_referer:                    false

http://symfony.com/doc/2.1/reference/configuration/security.html

因此重定向可以通过登录表单的隐藏输入或设置 default_target_path 来处理

'form' => array(
    'login_path' =>                     '/', 
    'check_path' =>                     '/app/login_check',
    'default_target_path' =>            '/app',
    'always_use_default_target_path' => true
),