Silex Authentication - Restrict access after 3 missed attempts - silex

Question

I'm new in Silex and I can not find how to change SecurityServiceProvider to restrict access for 24 hours after 3 bad connections.
The authentication works perfectly.
Thank you very much for your help and ideas.

Answer 1

You can create a CustomAuthenticationFailureHandler which extends the DefaultAuthenticationFailureHandler.
Create a class:
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationFailureHandler;
class CustomAuthenticationFailureHandler extends DefaultAuthenticationFailureHandler
{
/**
* (non-PHPdoc)
* #see \Symfony\Component\Security\Http\Authentication\DefaultAuthenticationFailureHandler::onAuthenticationFailure()
*/
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
// create a failure counter for the access restriction
return $this->httpUtils->createRedirectResponse($request, $this->options['failure_path']);
}
}
share this class:
$app['security.authentication.failure_handler.general'] = $app->share(function() use ($app) {
return new CustomAuthenticationFailureHandler($app['security.http_utils'], array(), $app);
});
where this failure handler is matching to the firewall named general:
// init the firewall
$app->register(new Silex\Provider\SecurityServiceProvider(), array(
'security.firewalls' => array(
'general' => array(
'pattern' => '^/',
'anonymous' => true,
'form' => array(
'login_path' => '/login',
'check_path' => '/admin/login_check'
),
...
)
)
);
you will also need a CustomAuthenticationSuccessHandler which extends the DefaultAuthenticationSuccessHandler:
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationSuccessHandler;
class CustomAuthenticationSuccessHandler extends DefaultAuthenticationSuccessHandler
{
/**
* (non-PHPdoc)
* #see \Symfony\Component\Security\Http\Authentication\DefaultAuthenticationSuccessHandler::onAuthenticationSuccess()
*/
public function onAuthenticationSuccess(Request $request, TokenInterface $token)
{
// handle the 24 hour restriction for the user ...
return $this->httpUtils->createRedirectResponse($request, $this->determineTargetUrl($request));
}
}
and share this class:
$app['security.authentication.success_handler.general'] = $app->share(function () use ($app) {
return new CustomAuthenticationSuccessHandler($app['security.http_utils'], array(), $app);
});
hope this helpful for you ...

Answer 2

Thanks to Ralf Hertsch for giving a clever answer, however as tekilatexee points, the Failure Handler does not accept an HttpUtils instance as first parameter to the constructor, if it extends DefaultAuthenticationFailureHandler without overriding the constructor.
Also, you don't need to write both Custom Handlers (one for failure, one for success), you could link only a Failure Handler, or only a Success Handler.
To instance correctly your Failure Handler extending the Symfony's default, the correct definition of the handler service is like this:
$app['security.authentication.failure_handler.general'] = $app->share(function() use ($app) {
return new CustomAuthenticationFailureHandler($app['kernel'], $app['security.http_utils']);
});
This passes the Symfony\Component\HttpKernel\HttpKernelInterface as first argument to the constructor.
However, if your Custom Handler instead of extending Symfony's default, implements Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface it just needs to implement onAuthenticationFailure that receives a Symfony's Request object and an AuthenticationException, and you could pass in the constructor, an instance of Doctrine\DBAL\Connection to log and check previous authentication failures, or any other custom set of services.