Symfony2, switch to HTTPS after authentication

Question

I want to force the user to use HTTPS instead of HTTP, but only after authentication. The only option I found is to force HTTPS for each controller / method. Anonymous users should use only HTTP.

How to install force-HTTPS only for authenticated users and force NOT to use HTTPS for unverified users in all controllers in my package?

Again - this is not about disabling HTTPS for authorization.

I want to use the same controllers for authenticated and non-authenticated users, but forcing registered users to use HTTPS and those who do not use HTTP. Basically add the requirement for HTTPS for ALL controllers when the user is authenticated.

This question is of particular relevance to Symfony 2. I want to do this using Symfony mechanisms. I know how to detect this thing, but it will break Twig links. Symfony can automatically switch to HTTPS, I just want to know how to do this based on the role of each user, and not based on the controller.

Answer 1

You might think that the access controller will do this for us:

access_control: - { role: ROLE_USER, requires_channel: https } - { role: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: http } 

But no ... I think it will be a very nice feature.

In this case, we can crack something along with the request listener using kernel events:

 namespace YourBundle\EventListener; use Symfony\Component\HttpKernel\Event\GetResponseEvent; use Symfony\Component\HttpFoundation\RedirectResponse; class RequestListener { public function onKernelRequest(GetResponseEvent $event) { $request = $event->getRequest(); // force ssl based on authentication if ($this->container->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY')) { if (!$request->isSecure()) { $request->server->set('HTTPS', true); $request->server->set('SERVER_PORT', 443); $event->setResponse(new RedirectResponse($request->getUri())); } } else { if ($request->isSecure()) { $request->server->set('HTTPS', false); $request->server->set('SERVER_PORT', 80); $event->setResponse(new RedirectResponse($request->getUri())); } } } } 

Define your listener in config.yml under services:

 myapp.request.listener: class: MyApp\MyBundle\EventListener\RequestListener tags: - { name: kernel.event_listener, event: kernel.request } 

More about events, etc. see symfony internals .

Answer 2

In Symfony 2.0.11, I get a redirect error. To solve this problem, I commented on the following lines in the listener.

 class RequestListener { public function onKernelRequest(GetResponseEvent $event) { $request = $event->getRequest(); // force ssl based on authentication if ($this->container->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY')) { if (!$request->isSecure()) { $request->server->set('HTTPS', true); $request->server->set('SERVER_PORT', 443); // $event->setResponse(new RedirectResponse($request->getUri())); } } else { if ($request->isSecure()) { $request->server->set('HTTPS', false); $request->server->set('SERVER_PORT', 80); // $event->setResponse(new RedirectResponse($request->getUri())); } } } }