Symfony4.4.28：按OWASP建议创建管理员与用户独立登录URL

完全可行，利用Symfony Security组件的多防火墙配置即可实现，这正好符合OWASP的安全隔离建议。以下是具体实现步骤：

1. 配置Security核心规则 #

修改config/packages/security.yaml，定义两个独立的防火墙、用户提供者和访问控制策略：

security:
    # 为不同实体配置密码加密规则
    encoders:
        App\Entity\Admin:
            algorithm: auto
        App\Entity\User:
            algorithm: auto

    # 定义两个独立的用户数据源
    providers:
        admin_provider:
            entity:
                class: App\Entity\Admin
                property: email
        user_provider:
            entity:
                class: App\Entity\User
                property: email

    # 配置双防火墙，分别处理/admin和/user路径
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # 管理员专属防火墙
        admin_firewall:
            pattern: ^/admin
            anonymous: true
            provider: admin_provider
            form_login:
                login_path: admin_login
                check_path: admin_login
                default_target_path: admin_dashboard
                username_parameter: _email
                password_parameter: _password
            logout:
                path: admin_logout
                target: admin_login

        # 普通用户专属防火墙
        user_firewall:
            pattern: ^/user
            anonymous: true
            provider: user_provider
            form_login:
                login_path: user_login
                check_path: user_login
                default_target_path: user_profile
                username_parameter: _email
                password_parameter: _password
            logout:
                path: user_logout
                target: user_login

    # 访问控制规则，限制路径访问权限
    access_control:
        - { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin, roles: ROLE_ADMIN }
        - { path: ^/user/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/user, roles: ROLE_USER }

2. 创建认证控制器 #

分别为管理员和普通用户编写独立的登录/登出控制器：

管理员认证控制器 #

// src/Controller/AdminSecurityController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;

class AdminSecurityController extends AbstractController
{
    /**
     * @Route("/admin/login", name="admin_login")
     */
    public function login(AuthenticationUtils $authenticationUtils): Response
    {
        $error = $authenticationUtils->getLastAuthenticationError();
        $lastUsername = $authenticationUtils->getLastUsername();

        return $this->render('admin/security/login.html.twig', [
            'last_username' => $lastUsername,
            'error' => $error,
        ]);
    }

    /**
     * @Route("/admin/logout", name="admin_logout")
     */
    public function logout()
    {
        throw new \LogicException('此方法无需实现，Symfony会自动拦截处理登出请求');
    }
}

普通用户认证控制器 #

// src/Controller/UserSecurityController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;

class UserSecurityController extends AbstractController
{
    /**
     * @Route("/user/login", name="user_login")
     */
    public function login(AuthenticationUtils $authenticationUtils): Response
    {
        $error = $authenticationUtils->getLastAuthenticationError();
        $lastUsername = $authenticationUtils->getLastUsername();

        return $this->render('user/security/login.html.twig', [
            'last_username' => $lastUsername,
            'error' => $error,
        ]);
    }

    /**
     * @Route("/user/logout", name="user_logout")
     */
    public function logout()
    {
        throw new \LogicException('此方法无需实现，Symfony会自动拦截处理登出请求');
    }
}

3. 创建独立登录模板 #

分别为两个角色创建不同的登录页面模板，避免共用模板带来的安全风险：

管理员登录模板 #

templates/admin/security/login.html.twig

{% extends 'base.html.twig' %}

{% block title %}管理员登录{% endblock %}

{% block body %}
    <h2>管理员后台登录</h2>
    {% if error %}
        <div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>
    {% endif %}
    <form method="post">
        <div>
            <label for="email">邮箱:</label>
            <input type="email" id="email" name="_email" value="{{ last_username }}" required>
        </div>
        <div>
            <label for="password">密码:</label>
            <input type="password" id="password" name="_password" required>
        </div>
        <button type="submit">登录</button>
    </form>
{% endblock %}

普通用户登录模板 #

templates/user/security/login.html.twig

{% extends 'base.html.twig' %}

{% block title %}用户登录{% endblock %}

{% block body %}
    <h2>用户登录</h2>
    {% if error %}
        <div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>
    {% endif %}
    <form method="post">
        <div>
            <label for="email">邮箱:</label>
            <input type="email" id="email" name="_email" value="{{ last_username }}" required>
        </div>
        <div>
            <label for="password">密码:</label>
            <input type="password" id="password" name="_password" required>
        </div>
        <button type="submit">登录</button>
    </form>
{% endblock %}

4. 实体类要求 #

确保Admin和User实体都实现Symfony\Component\Security\Core\User\UserInterface接口，或继承Symfony\Component\Security\Core\User\AbstractUser类，实现必要的角色、密码相关方法。

关键特性说明 #

• 两个防火墙完全独立，管理员登录状态不会影响普通用户区域，反之亦然，实现了严格的安全隔离
• 各自使用独立的用户数据源，避免跨角色的信息泄露风险
• 登录路径完全分离，符合OWASP关于避免统一登录入口的安全建议

内容的提问来源于stack exchange，提问作者Riadh