@@ -100,22 +100,20 @@ This requires you to implement several methods::
100100 */
101101 public function getCredentials(Request $request)
102102 {
103- return [
104- 'token' => $request->headers->get('X-AUTH-TOKEN'),
105- ];
103+ return $request->headers->get('X-AUTH-TOKEN');
106104 }
107105
108106 public function getUser($credentials, UserProviderInterface $userProvider)
109107 {
110- $apiToken = $credentials['token'];
111-
112- if (null === $apiToken) {
108+ if (null === $credentials) {
109+ // The token header was empty, authentication fails with 401
113110 return;
114111 }
115112
116- // if a Userobject , checkCredentials() is called
113+ // if a Useris returned , checkCredentials() is called
117114 return $this->em->getRepository(User::class)
118- ->findOneBy(['apiToken' => $apiToken]);
115+ ->findOneBy(['apiToken' => $credentials])
116+ ;
119117 }
120118
121119 public function checkCredentials($credentials, UserInterface $user)
@@ -136,13 +134,14 @@ This requires you to implement several methods::
136134 public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
137135 {
138136 $data = [
137+ // you may ant to customize or obfuscate the message first
139138 'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
140139
141140 // or to translate this message
142141 // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
143142 ];
144143
145- return new JsonResponse($data, Response::HTTP_FORBIDDEN );
144+ return new JsonResponse($data, Response::HTTP_UNAUTHORIZED );
146145 }
147146
148147 /**
@@ -211,10 +210,10 @@ Finally, configure your ``firewalls`` key in ``security.yaml`` to use this authe
211210 <config >
212211<!-- ...-->
213212
214- <firewall name = " main "
215- pattern = " ^/ "
216- anonymous = " true "
217- >
213+ <!-- if you want, disable storing the user in the session
214+ add 'stateless="true"' to the firewall -->
215+ < firewall name = " main " pattern = " ^/ " >
216+ < anonymous / >
218217 <logout />
219218
220219 <guard >
@@ -244,6 +243,8 @@ Finally, configure your ``firewalls`` key in ``security.yaml`` to use this authe
244243 TokenAuthenticator::class,
245244 ],
246245 ],
246+ // if you want, disable storing the user in the session
247+ // 'stateless' => true,
247248 // ...
248249 ],
249250 ],