Symfony 4自定义SimpleFormAuthenticator验证后未登录问题

我帮你分析下代码里的问题，以及对应的修复方案：

核心问题分析 #

你的认证器逻辑跳过了Symfony Security的标准流程，直接自己查询数据库验证密码，这会导致Security组件无法正确识别用户的认证状态，最终出现跳转首页但未认证的情况。另外还有几处细节配置和代码逻辑需要调整。

修复步骤 #

1. 修正认证器的密码验证逻辑（注入编码器并使用UserProvider） #

首先需要给认证器注入密码编码器，让Symfony来处理密码验证，而不是直接对比数据库值：

namespace App\Security;
use App\Entity\User;
use App\Repository\UserRepository;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\Encoder\PasswordEncoderInterface;
use Symfony\Component\Security\Http\Authentication\SimpleFormAuthenticatorInterface;

class TestAuthenticator implements SimpleFormAuthenticatorInterface
{
    /**
     * @var UserRepository
     */
    private $userRepository;
    
    /**
     * @var PasswordEncoderInterface
     */
    private $passwordEncoder;

    public function __construct(UserRepository $userRepository, PasswordEncoderInterface $passwordEncoder)
    {
        $this->userRepository = $userRepository;
        $this->passwordEncoder = $passwordEncoder;
    }

    public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
    {
        try {
            // 通过配置的UserProvider加载用户，而非直接查询数据库
            $user = $userProvider->loadUserByUsername($token->getUser());
        } catch (UsernameNotFoundException $e) {
            throw new AuthenticationException('用户名或密码错误');
        }

        $password = $token->getCredentials();
        // 使用编码器验证密码（即使是明文，编码器也会按配置正确处理）
        if (!$this->passwordEncoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
            throw new AuthenticationException('用户名或密码错误');
        }

        return new UsernamePasswordToken(
            $user,
            $user->getPassword(),
            $providerKey,
            $user->getRoles()
        );
    }

    public function supportsToken(TokenInterface $token, $providerKey)
    {
        // 更精准地匹配当前认证器处理的Token
        return $token instanceof UsernamePasswordToken 
            && $token->getProviderKey() === $providerKey
            && (is_string($token->getUser()) || $token->getUser() instanceof User);
    }

    public function createToken(Request $request, $username, $password, $providerKey)
    {
        return new UsernamePasswordToken($username, $password, $providerKey);
    }
}

2. 确保User实体正确实现UserInterface #

你的User实体必须实现Symfony的UserInterface，否则Security组件无法识别它为合法用户：

use Symfony\Component\Security\Core\User\UserInterface;

class User implements UserInterface
{
    // ... 你的实体字段定义

    public function getRoles()
    {
        // 返回用户角色数组，例如默认返回普通用户角色
        return ['ROLE_USER'];
    }

    public function getPassword()
    {
        return $this->password;
    }

    public function getSalt()
    {
        // 明文密码可以返回null
        return null;
    }

    public function getUsername()
    {
        return $this->username;
    }

    public function eraseCredentials()
    {
        // 清空敏感临时数据，明文场景下可留空
    }

    // 实现序列化接口，确保用户信息能正确存入session
    public function serialize()
    {
        return serialize([
            $this->id,
            $this->username,
            $this->password,
        ]);
    }

    public function unserialize($serialized)
    {
        list(
            $this->id,
            $this->username,
            $this->password,
        ) = unserialize($serialized);
    }
}

3. 完善security.yml配置 #

给simple_form指定你配置的用户提供者，避免使用默认值：

security:
    encoders:
        App\Entity\User:
            algorithm: plain_text
    providers:
        our_db_provider:
            entity:
                class: App\Entity\User
                property: username
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            anonymous: ~
            simple_form:
                login_path: /login
                check_path: /login_check
                remember_me: true
                authenticator: App\Security\TestAuthenticator
                provider: our_db_provider # 新增：指定使用你的数据库用户提供者
            remember_me:
                lifetime: 31536000
                always_remember_me: true
                remember_me_parameter: _remember_me
                path: /
                domain: ~
                secret: "asdasdasd"
            logout:
                path: /logout
                target: /login
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/forgot, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/, roles: ROLE_USER }

4. 检查登录模板字段名 #

确保登录表单的字段名是_username和_password（SimpleFormAuthenticator默认读取这两个参数）：

<form action="{{ path('login_check') }}" method="post">
    <div>
        <label>用户名:</label>
        <input type="text" name="_username" required>
    </div>
    <div>
        <label>密码:</label>
        <input type="password" name="_password" required>
    </div>
    <div>
        <label><input type="checkbox" name="_remember_me"> 记住我</label>
    </div>
    <button type="submit">登录</button>
</form>

为什么之前的代码无法正常工作？ #

你直接通过UserRepository查询用户并对比密码，跳过了Symfony Security的UserProvider和密码编码器流程，这会导致Security组件无法正确跟踪用户的认证状态，也无法集成记住我、权限检查等核心功能。使用标准流程后，Security才能正确将认证后的用户信息存入Session，完成登录状态的维持。

内容的提问来源于stack exchange，提问作者amirmodi