Php Symfony3和Ajax身份验证

我希望成员从前端登录，我已经在下面定义了我的身份验证处理程序，并将其添加为一个服务，该服务按预期为我提供json响应

<?php

namespace AppBundle\Handler;

use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Routing\RouterInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Routing\Router;
use Symfony\Component\Security\Core\SecurityContext;
use Symfony\Component\Security\Core\Exception\AuthenticationException;


class AuthenticationHandler implements AuthenticationSuccessHandlerInterface, AuthenticationFailureHandlerInterface
{

protected $router;
//protected $security;
protected $userManager;
protected $service_container;

public function __construct(RouterInterface $router, $userManager, $service_container)
{
    $this->router = $router;
    //$this->security = $security;
    $this->userManager = $userManager;
    $this->service_container = $service_container;

}
public function onAuthenticationSuccess(Request $request, TokenInterface $token) {
    if ($request->isXmlHttpRequest()) {
        $result = array('success' => true);
        $response = new Response(json_encode($result));
        $response->headers->set('Content-Type', 'application/json');
        return $response;
    }
    else {
        // Create a flash message with the authentication error message
        $request->getSession()->set(SecurityContext::AUTHENTICATION_ERROR, $exception);
        $url = $this->router->generate('fos_user_security_login');

        return new RedirectResponse($url);
    }

    return new RedirectResponse($this->router->generate('anag_new')); 
} 
public function onAuthenticationFailure(Request $request, AuthenticationException $exception) {

    if ($request->isXmlHttpRequest()) {
        $result = array('success' => false, 'message' => $exception->getMessage());
        $response = new Response(json_encode($result));
        $response->headers->set('Content-Type', 'application/json');
        return $response;
    }
    return new Response();
}
}

这是我的保安

firewalls:
    # disables authentication for assets and the profiler, adapt it according to your needs
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    admin:
        pattern:            /admin(.*)
        context:            user
        form_login:
            provider:       fos_userbundle
            login_path:     /admin/login
            use_forward:    false
            check_path:     /admin/login_check
            failure_path:   null
        logout:
            path:           /admin/logout
            target:         /admin/login
        anonymous:          true

    main:
        pattern:             .*
        context:             user
        form_login:
            provider:       fos_userbundle
            login_path:     /login
            use_forward:    false
            check_path:     fos_user_security_check
            failure_path:   null
            success_handler: authentication_handler
            failure_handler: authentication_handler
        logout:             true
        anonymous:          true

路由.yml

fos_user_security_check:
    path:   /login_check
    defaults:
        _controller:  FOSUserBundle:Security:check

fos_user_security_logout:
    path:   /logout
    defaults:
        _controller:  FOSUserBundle:Security:logout 

---

对我来说，实现API身份验证最简单的方法是实现全新的Guard身份验证接口

这个简单的类允许您定义流程，该流程实例化、处理和后处理身份验证

启用该服务非常简单

# app/config/security.yml
security:
    # ...

    firewalls:
        # ...

        main:
            anonymous: ~
            logout: ~

            guard:
                authenticators:
                    - app.my_authenticator

            # if you want, disable storing the user in the session
            # stateless: true

            # maybe other things, like form_login, remember_me, etc
            # ...

您还需要为此提供一个用户

使用Guard，您可以处理任何类型的自定义身份验证（承载、表单、cookie、获取令牌等）

# app/config/security.yml
security:
    # ...

    firewalls:
        # ...

        main:
            anonymous: ~
            logout: ~

            guard:
                authenticators:
                    - app.my_authenticator

            # if you want, disable storing the user in the session
            # stateless: true

            # maybe other things, like form_login, remember_me, etc
            # ...