Symfony Security：登录表单集成Recaptcha遇阻求助

看起来你遇到的核心问题是**SimpleFormAuthenticatorInterface的authenticateToken()方法无法直接获取Request对象**，导致你没法拿到前端提交的Recaptcha响应参数，进而跳过了验证逻辑。下面提供两种解决方案，一种是改造你现有的代码，另一种是使用Symfony更推荐的现代认证方式。

方案1：改造现有SimpleFormAuthenticator代码 #

我们可以在createToken()方法中把Recaptcha的响应值和密码一起封装到Token的credentials里，这样就能在authenticateToken()中取出验证了。

修改你的CaptchaAuthenticator代码： #

class CaptchaAuthenticator implements SimpleFormAuthenticatorInterface { 
    private $encoder; 
    public function __construct(UserPasswordEncoderInterface $encoder) { 
        $this->encoder = $encoder; 
    } 

    // 1. 改造createToken：把Recaptcha响应存入credentials
    public function createToken(Request $request, $username, $password, $providerKey) { 
        $captchaResponse = $request->get('g-recaptcha-response');
        // 将密码和验证码包装成数组作为credentials
        return new UsernamePasswordToken(
            $username, 
            ['password' => $password, 'captcha' => $captchaResponse], 
            $providerKey
        ); 
    } 

    public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey) { 
        try { 
            $user = $userProvider->loadUserByUsername($token->getUsername()); 
        } catch (UsernameNotFoundException $e) { 
            throw new CustomUserMessageAuthenticationException('Gebruikersnaam of wachtwoord ongeldig'); 
        } 

        // 2. 从credentials中取出密码和验证码
        $credentials = $token->getCredentials();
        $passwordValid = $this->encoder->isPasswordValid($user, $credentials['password']); 

        if ($passwordValid) { 
            // 3. 执行Recaptcha验证
            if( !$this->captchaverify($credentials['captcha']) ) { 
                throw new CustomUserMessageAuthenticationException( 
                    'Captcha-verificatie is mislukt!', 
                    array(), 
                    412 
                ); 
            } 

            return new UsernamePasswordToken( 
                $user, $user->getPassword(), $providerKey, $user->getRoles() 
            ); 
        } 

        throw new CustomUserMessageAuthenticationException('Invalid username or password'); 
    } 

    public function supportsToken(TokenInterface $token, $providerKey) { 
        return $token instanceof UsernamePasswordToken && $token->getProviderKey() === $providerKey; 
    } 

    public function captchaverify($recaptcha){ 
        $url = "https://www.google.com/recaptcha/api/siteverify"; 
        $ch = curl_init(); 
        curl_setopt($ch, CURLOPT_URL, $url); 
        curl_setopt($ch, CURLOPT_HEADER, 0); 
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); 
        curl_setopt($ch, CURLOPT_POST, true); 
        curl_setopt($ch, CURLOPT_POSTFIELDS, array( 
            "secret"=>"YOUR_RECAPTCHA_SECRET_KEY", // 替换为你的密钥
            "response" => $recaptcha,
            "remoteip" => $_SERVER['REMOTE_ADDR'] // 可选：添加用户IP增强验证
        )); 
        $response = curl_exec($ch); 
        curl_close($ch); 
        $data = json_decode($response); 
        return $data->success; 
    } 
} 

方案2：改用Symfony推荐的AbstractFormLoginAuthenticator（更灵活） #

SimpleFormAuthenticator是比较旧的实现方式，Symfony现在更推荐使用Guard组件的AbstractFormLoginAuthenticator，它能直接在方法中获取Request对象，逻辑更清晰。

步骤1：创建新的认证器 #

namespace App\Security;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
use Symfony\Component\Security\Guard\AbstractFormLoginAuthenticator;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Routing\RouterInterface;

class CaptchaFormAuthenticator extends AbstractFormLoginAuthenticator
{
    private $encoder;
    private $router;

    public function __construct(UserPasswordEncoderInterface $encoder, RouterInterface $router)
    {
        $this->encoder = $encoder;
        $this->router = $router;
    }

    // 指定哪些请求需要此认证器处理（比如登录POST请求）
    public function supports(Request $request)
    {
        return 'app_login' === $request->attributes->get('_route')
            && $request->isMethod('POST');
    }

    // 从请求中提取所有认证所需数据（用户名、密码、验证码）
    public function getCredentials(Request $request)
    {
        $credentials = [
            'username' => $request->request->get('_username'),
            'password' => $request->request->get('_password'),
            'captcha' => $request->request->get('g-recaptcha-response'),
        ];

        // 保存用户名到会话，用于登录失败后回显
        $request->getSession()->set(
            \Symfony\Component\Security\Core\Security::LAST_USERNAME,
            $credentials['username']
        );

        return $credentials;
    }

    // 根据用户名加载用户
    public function getUser($credentials, UserProviderInterface $userProvider)
    {
        $username = $credentials['username'];

        try {
            return $userProvider->loadUserByUsername($username);
        } catch (UsernameNotFoundException $e) {
            throw new CustomUserMessageAuthenticationException('Gebruikersnaam of wachtwoord ongeldig');
        }
    }

    // 验证密码和Recaptcha
    public function checkCredentials($credentials, UserInterface $user)
    {
        // 验证密码
        $passwordValid = $this->encoder->isPasswordValid($user, $credentials['password']);
        if (!$passwordValid) {
            throw new CustomUserMessageAuthenticationException('Invalid username or password');
        }

        // 验证Recaptcha
        if (!$this->captchaverify($credentials['captcha'])) {
            throw new CustomUserMessageAuthenticationException('Captcha-verificatie is mislukt!');
        }

        return true;
    }

    // 登录成功后的跳转逻辑
    public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
    {
        // 跳转到之前访问的页面，没有则跳转到首页
        $targetPath = $request->getSession()->get('_security.main.target_path');
        if (!$targetPath) {
            $targetPath = $this->router->generate('homepage');
        }

        return new RedirectResponse($targetPath);
    }

    // 指定登录页面的路由
    protected function getLoginUrl()
    {
        return $this->router->generate('app_login');
    }

    // Recaptcha验证方法
    private function captchaverify($recaptcha){
        $url = "https://www.google.com/recaptcha/api/siteverify"; 
        $ch = curl_init(); 
        curl_setopt($ch, CURLOPT_URL, $url); 
        curl_setopt($ch, CURLOPT_HEADER, 0); 
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); 
        curl_setopt($ch, CURLOPT_POST, true); 
        curl_setopt($ch, CURLOPT_POSTFIELDS, [
            "secret" => "YOUR_RECAPTCHA_SECRET_KEY", // 替换为你的密钥
            "response" => $recaptcha,
            "remoteip" => $_SERVER['REMOTE_ADDR']
        ]); 
        $response = curl_exec($ch); 
        curl_close($ch); 
        $data = json_decode($response); 
        return $data->success; 
    }
}

步骤2：更新security.yaml配置 #

把原来的simple_form配置替换为Guard认证器：

security:
    # ... 其他配置
    firewalls:
        main:
            # ... 其他配置（比如anonymous、logout等）
            guard:
                authenticators:
                    - App\Security\CaptchaFormAuthenticator

最后：确保前端表单正确渲染Recaptcha #

在你的登录模板中添加Recaptcha的脚本和组件：

{# 登录表单内添加Recaptcha组件 #}
<div class="g-recaptcha" data-sitekey="YOUR_RECAPTCHA_SITE_KEY"></div>

{# 引入Recaptcha脚本 #}
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

注意替换YOUR_RECAPTCHA_SITE_KEY和YOUR_RECAPTCHA_SECRET_KEY为你在Google Recaptcha控制台获取的密钥，并且确保你的域名已添加到Recaptcha的允许列表中。

内容的提问来源于stack exchange，提问作者Misha Karas