如何在不重新登录的情况下更新 Symfony 4 中安全令牌中的角色

Question

I'm trying to update User's roles after the user confirms its phone number.

I make the update in the database:

$user->setRoles(["ROLE_USER"]);
$em->persist($user);

That works fine and updates the users's role in the database. (Before, users have "ROLE_UNACTIVATED" group).

However, it doesn't update the user's roles in the session (security token), so the user needs to logout and then log in one more time.

So, the question is how to update User's roles in security token?

Answer 1

I'm not completely sure that it's a right way to do that, but what I did is manually re-authenticate the user

public function activation(Request $request, GuardAuthenticatorHandler $guardHandler, LoginFormAuthenticator $formAuthenticator)
{
    ...
    //re-authenticate user to update roles in security token
    $guardHandler->authenticateUserAndHandleSuccess(
        $user,
        $request,
        $formAuthenticator,
        'main'
    );
}

and that automatically updates security token of a user without logging out.