Symfony 4 Restful API集成JWT与Facebook登录技术咨询

我之前在Symfony 4项目里刚好实现过Facebook登录和JWT结合的需求，完全可以搞定，给你一步步拆解可行方案：

1. 安装必要的依赖包 #

首先需要引入OAuth2客户端工具包和Facebook的身份验证提供者，运行以下Composer命令：

composer require knpuniversity/oauth2-client-bundle league/oauth2-facebook

2. 配置Facebook OAuth客户端 #

在config/packages/knpu_oauth2_client.yaml中添加Facebook应用的配置：

knpu_oauth2_client:
    clients:
        facebook_main:
            type: facebook
            client_id: '%env(FB_CLIENT_ID)%' # 从Facebook开发者平台获取你的应用ID
            client_secret: '%env(FB_CLIENT_SECRET)%' # 从Facebook开发者平台获取你的应用密钥
            graph_api_version: v18.0 # 根据Facebook当前的API版本调整
            redirect_route: api_login_facebook_check # 后续会用到的回调路由标识
            redirect_params: {}

然后在.env文件中填入你的Facebook应用凭证：

FB_CLIENT_ID=your-facebook-client-id
FB_CLIENT_SECRET=your-facebook-client-secret

3. 创建自定义Guard Authenticator处理登录逻辑 #

我们需要写一个自定义的Guard认证器，用来验证Facebook的access token、匹配/创建用户，最后生成JWT返回给前端。

3.1 编写Authenticator类 #

在src/Security/FacebookAuthenticator.php中创建以下代码：

<?php

namespace App\Security;

use App\Entity\User;
use Doctrine\ORM\EntityManagerInterface;
use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
use KnpU\OAuth2ClientBundle\Client\ClientRegistry;
use League\OAuth2\Client\Provider\FacebookUser;

class FacebookAuthenticator extends AbstractGuardAuthenticator
{
    private $clientRegistry;
    private $em;
    private $jwtManager;

    public function __construct(ClientRegistry $clientRegistry, EntityManagerInterface $em, JWTTokenManagerInterface $jwtManager)
    {
        $this->clientRegistry = $clientRegistry;
        $this->em = $em;
        $this->jwtManager = $jwtManager;
    }

    // 判断当前请求是否为Facebook登录请求
    public function supports(Request $request)
    {
        return $request->getPathInfo() === '/api/login/facebook' && $request->isMethod('POST');
    }

    // 提取前端传来的Facebook access token
    public function getCredentials(Request $request)
    {
        $data = json_decode($request->getContent(), true);
        return $data['access_token'] ?? null;
    }

    // 验证token有效性，匹配或创建用户
    public function getUser($credentials, UserProviderInterface $userProvider)
    {
        $facebookClient = $this->clientRegistry->getClient('facebook_main');
        
        try {
            /** @var FacebookUser $facebookUser */
            $facebookUser = $facebookClient->fetchUserFromToken($credentials);
            
            // 检查数据库中是否已存在该Facebook账号关联的用户
            $user = $this->em->getRepository(User::class)->findOneBy(['facebookId' => $facebookUser->getId()]);
            
            if (!$user) {
                // 如果不存在，创建新用户（根据你的User实体字段调整）
                $user = new User();
                $user->setFacebookId($facebookUser->getId());
                $user->setEmail($facebookUser->getEmail());
                $user->setUsername($facebookUser->getName());
                // 设置随机密码（Facebook登录用户不需要密码登录）
                $user->setPassword(password_hash(uniqid(), PASSWORD_BCRYPT));
                $this->em->persist($user);
                $this->em->flush();
            }
            
            return $user;
        } catch (\Exception $e) {
            throw new AuthenticationException('Invalid Facebook access token');
        }
    }

    public function checkCredentials($credentials, UserInterface $user)
    {
        // 已通过Facebook验证token有效性，直接返回true
        return true;
    }

    // 登录成功后返回JWT令牌
    public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
    {
        $user = $token->getUser();
        $jwt = $this->jwtManager->create($user);
        
        return new JsonResponse([
            'token' => $jwt
        ]);
    }

    // 登录失败返回错误信息
    public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        return new JsonResponse([
            'error' => $exception->getMessage()
        ], Response::HTTP_UNAUTHORIZED);
    }

    public function start(Request $request, AuthenticationException $authException = null)
    {
        return new JsonResponse([
            'error' => 'Authentication required'
        ], Response::HTTP_UNAUTHORIZED);
    }

    public function supportsRememberMe()
    {
        return false;
    }
}

3.2 更新User实体 #

需要给你的User实体添加facebookId字段，用来关联Facebook账号：

// src/Entity/User.php
// ...
private $facebookId;

public function getFacebookId(): ?string
{
    return $this->facebookId;
}

public function setFacebookId(?string $facebookId): self
{
    $this->facebookId = $facebookId;

    return $this;
}

然后生成并执行数据库迁移：

php bin/console make:migration
php bin/console doctrine:migrations:migrate

4. 更新Security配置 #

修改config/packages/security.yaml，添加Facebook登录的防火墙规则，并开放端点的匿名访问权限：

security:
    # ... 保留原有配置
    firewalls:
        # ... 保留原有防火墙配置
        facebook_login:
            pattern: ^/api/login/facebook
            stateless: true
            anonymous: true
            guard:
                authenticators:
                    - App\Security\FacebookAuthenticator
    # ... 保留原有access_control配置，新增以下规则
    access_control:
        # ... 保留原有规则
        - { path: ^/api/login/facebook, roles: IS_AUTHENTICATED_ANONYMOUSLY }

5. 测试接口 #

前端通过Facebook SDK获取用户的access token后，向POST /api/login/facebook发送JSON请求：

{
    "access_token": "用户获取到的Facebook access token"
}

验证成功后，接口会返回JWT令牌，后续即可用该令牌访问其他需要认证的API端点。

内容的提问来源于stack exchange，提问作者Andrei Nt