使用批注保护Symfony2 Controller的操作免受未经授权的请求

Question

I can't seem to find out if it is possible to protect a Controller's Action when the user is not logged in using a Custom Annotation .

This is what I want to achieve:

...
class FooController extends Controller
{
    ...

    /*
    * The code bellow should only be executed if the user 
    * is authorized, otherwise should throw an exception 
    * or something.
    *
    * @Authorized
    */
    public function barAction($cid) {
        // do stuff only if user is authorized
    }

    ...
}

I know I could do this using some sort of " Decorator Design Pattern " but what I'd really want is something more like Python 's Decorator using PHP Annotations

Is this posible? How would I do it?

Answer 1

If you're using the SensioFrameworkExtraBundle you can annotate the controller class . From their example,

use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;

class PostController extends Controller
{
    /**
     * @Security("has_role('ROLE_ADMIN')")
     */
    public function indexAction()
    {
        // ...
    }
}

Another alternative is the JMSSecurityExtraBundle to secure your service layer , eg,

namespace Acme\HelloBundle\Newsletter;

use JMS\SecurityExtraBundle\Annotation\Secure;
// ...

class NewsletterManager
{

    /**
     * @Secure(roles="ROLE_NEWSLETTER_ADMIN")
     */
    public function sendNewsletter()
    {
        // ...
    }

    // ...
}